BeyondTrust's Remote Support product was being used as a way into other companies for about six weeks before the vendor shipped a fix. According to SecurityWeek's account on 16 October, a China-linked group tracked as Armory Castle, also known as UNC5221 and Warp Panda, began exploiting CVE-2026-102764 on 29 August. The score is 9.3, and the flaw is described as improper validation of message origins that lets an attacker perform file operations on the appliance. Every Remote Support release up to and including 26.2.3 is affected.
The timeline is the story
Mandiant and Google Threat Intelligence Group reported the zero-day use. BeyondTrust says it identified the flaw on 28 September, had a patch on the 30th, then spent more time testing it and closing other routes before shipping on 8 October (advisory BT26-05). SaaS customers were patched by 9 October. Self-hosted appliances without automatic updates are still waiting on whoever owns them to act. If that is you, the gap between 29 August and today is the period to investigate, not the days since the patch landed.
What the intruders did once inside
The reported tradecraft is tidy rather than flashy: a small PHP webshell called Sawfly for the foothold, a SOCKS5 tunnelling tool called Bareclaw, root on the appliance host, harvested credentials, and logs deleted afterwards. The group then moved on with admin credentials, adjusted account permissions and used the product's own file transfer feature to pull out internal documents such as software inventories. Nothing in that list needs a second vulnerability. A remote support tool already has the reach that attackers spend weeks building elsewhere: it is meant to touch many machines, and people expect it to.
What to do this week
- Find every Remote Support instance, including the ones a regional team stood up and forgot. Confirm the version and apply the BT26-05 patch; anything older than 24.3.1 has to be upgraded first.
- Assume that a patch does not undo a compromise. Look back to the end of August for new PHP files in web directories, unexpected SOCKS or tunnelling processes, and gaps in the logs. A hole where the logs should be is a finding in itself.
- Rotate the credentials the appliance has ever held: service accounts, integrated directory accounts, anything stored for jump access.
- Look at what the appliance can reach. Ask whether it needs a flat path to the whole estate, and whether file transfer should be switched off.
- Send the appliance's logs somewhere the appliance cannot edit.
I could not find a CISA catalogue entry for this CVE in the coverage, so do not wait for a federal deadline to set your own. Reports on the group's other targets, security device providers among them, suggest this is deliberate selection of suppliers whose customers are the real prize. If you want a second pair of eyes on remote access tooling, write to sales@halfteck.com.