BeyondTrust patches zero-day exploited in attacks since August

Armory Castle

This suspected China-nexus espionage actor, also tracked as "Warp Panda" by CrowdStrike and formerly UNC5221, is identified as the group actively exploiting the BeyondTrust zero-day. Mandiant researchers were the first to spot their initial attacks, detailing how the group leveraged the flaw to gain initial access and then escalate to root privileges on compromised devices. Their modus operandi includes enabling Set User ID (SUID) permissions to achieve this elevated control.

Following privilege escalation, Armory Castle deployed new custom malware, specifically the Sawfly web shell and Bareclaw tunneler, to maintain persistence and facilitate further malicious activities. They also engaged in tactics to evade detection, such as wiping logs, and performed lateral movement within victim networks. This was achieved by using compromised Administrator credentials to open remote sessions on downstream systems, demonstrating a comprehensive post-exploitation strategy.

The group has a history of targeting zero-day vulnerabilities in network edge appliances, including those from Citrix NetScaler and Ivanti Connect Secure, since at least October 2023. Their pattern involves exploiting these flaws to breach enterprise networks and deploy new custom malware. Mandiant warns that Armory Castle often conducts widespread exploitation after public disclosure of vulnerabilities they previously exploited as zero-days, suggesting a potential for broader attacks related to CVE-2026-102764.

CVE-2026-102764

This critical authentication bypass vulnerability affects BeyondTrust Remote Support (RS) versions 26.2.3 and earlier. It allows unprivileged remote attackers to perform file operations on unpatched appliances, serving as the initial entry point for the "Armory Castle" threat actor. The active exploitation of this flaw since late August underscores its severity and the immediate risk it posed to BeyondTrust customers.

The vulnerability's impact extends beyond initial access, as it facilitated the escalation to root privileges on compromised appliance hosts. Mandiant emphasized that achieving root-level control granted attackers access to every credential the appliance stored or brokered. This level of compromise also provided the ability to modify files that would persist even after reboots and configuration resets, making remediation challenging without thorough investigation.

Given the nature of the exploit, any BeyondTrust appliance running a vulnerable version and reachable from the internet during the exploitation window should be considered potentially compromised. This necessitates a comprehensive review and patching, even for organizations that believe they haven't been directly targeted, due to the opportunistic nature of such attacks.

BeyondTrust

BeyondTrust, a provider of identity security services to over 20,000 customers globally, including government agencies and a significant portion of Fortune 100 companies, quickly moved to patch the identified zero-day. The company patched all Remote Support and Privileged Remote Access SaaS customers on October 8, demonstrating a rapid response for its cloud-based offerings. However, self-hosted installations require manual patching if automatic updates are not enabled, placing the onus on customers to secure their environments.

This incident is not isolated for BeyondTrust, as the company has faced a string of other critical vulnerabilities exploited in the wild in recent years. Notably, another critical remote code execution flaw (CVE-2026-1731) was exploited to establish WebSocket channels and deploy ransomware. Furthermore, the Chinese state-backed Silk Typhoon hacking group is believed to have exploited two other zero-days (CVE-2024-12356 and CVE-2024-12686) to compromise BeyondTrust's systems and use a stolen API key to breach 17 Remote Support SaaS instances, including one belonging to the U.S. Treasury Department.

The repeated targeting of BeyondTrust products by sophisticated threat actors, including state-backed groups, underscores the critical importance of these identity security solutions within enterprise and government infrastructures. The company's role in managing privileged access makes its products high-value targets for espionage and disruptive campaigns, necessitating continuous vigilance and robust security measures from both the vendor and its extensive customer base.