If you run self-hosted BeyondTrust Remote Support, stop and check your version. Per SecurityWeek, a China-linked espionage group has been exploiting CVE-2026-102764 (CVSS 9.3) as a zero-day since August 29. It is an improper validation of message origins that lets attackers perform file operations on RS appliances.
What is affected and the fix
All RS versions up to and including 26.2.3. The fix is the BT26-05-RS patch for 24.3.1 through 26.2.3; anything older than 24.3.1 has to upgrade first, then patch. BeyondTrust says all Remote Support SaaS customers were patched as of October 9. Self-hosted customers need to apply it themselves if automatic updates are off — BeyondTrust documents how to enable automatic critical updates for on-prem RS.
Who and how
Mandiant and Google Threat Intelligence attribute the activity to Armory Castle (also tracked as UNC5221 and Warp Panda). After getting in, the group dropped the Sawfly PHP webshell and the Bareclaw SOCKS5 tunneler, got root on the appliance host, harvested credentials, and systematically deleted system, web server and application logs. Then they pivoted into the RS application with stolen admin credentials, tweaked permissions to control remote systems, and used RS’s own file transfer to pull internal docs like software inventories.
That is the nightmare with remote-support boxes. They are built to reach everything, so owning one is owning a lot.
What I would do today
Patch now. Then assume the logs may not tell the whole story — this group deletes them. Review admin accounts and permission changes in RS, rotate credentials the appliance could touch, and look for unexpected PHP files and outbound tunnels from the box. Same group has a history with Citrix NetScaler and Ivanti Connect Secure zero-days, so check your other edge gear while you are at it.
Have a blessed day! And Happy Hacking!