China-Linked Actor Had Root on BeyondTrust Since August

BeyondTrust published security advisory BT26-05 on 15 October 2026, disclosing a critical vulnerability in its Remote Support appliances that it scores 9.3 on CVSSv4. The flaw, CVE-2026-102764, is an improper origin validation weakness in an internal messaging component, and it affects every Remote Support version up to and including 26.2.3.

Google's Threat Intelligence Group published Mandiant's incident response findings the same day. Mandiant found that ARMORY CASTLE, a suspected PRC-nexus espionage actor it previously tracked as UNC5221, had exploited the vulnerability as a zero-day in late August 2026. Successful exploitation lets an unauthenticated remote attacker perform file operations on the appliance.

From an unprivileged web shell to a root backdoor

The sequence Mandiant reconstructed starts with POST requests to a staging file it could not recover. About eleven minutes later the file system recorded a PHP web shell, which Google named SAWFLY, written to the appliance's public web root. SAWFLY returns HTTP 404 to any request that does not carry one obfuscated parameter, which keeps it out of the way of crawlers and vulnerability scanners.

SAWFLY ran as the site's unprivileged service account, so the actor copied the system shell to a file named dbus-authd, gave it root ownership and set the set-user-ID bit, turning an innocuous-looking binary into a persistent root shell. With root, the actor ran the appliance's own bt-secrets utility, trying three command variants to dump first the site account's credential vault and then the appliance-wide password safe, before deleting the bt-secrets log and its archives.

Persistence went into BeyondTrust's configuration machinery rather than the operating system. The actor created a startup script called zz-root-persist that appends a passwordless sudo entry for the site service account to the appliance's sudoers template, then forces the appliance to rebuild its active sudoers file. A reboot or a configuration reset, which would wipe hand edits made directly to the live file, reinstates the backdoor instead of removing it.

A second implant, a tunneler written in C that Google named BARECLAW, provided a SOCKS5 proxy over WebSocket. To reach it from outside, the actor edited the appliance's HAProxy configuration so that one specific URI path routes to the tunneler listening on localhost port 19800. Bound only to the loopback address, that listener does not show up in an external port scan. Mandiant also recorded a single command deleting fourteen host, web server and application log files.

Why the disclosure itself is the risk

Google says ARMORY CASTLE has been active since at least October 2023 and has repeatedly switched from selective zero-day use to broad opportunistic exploitation once a flaw becomes public, racing patch deployment. It cites what it observed after the 2024 disclosure of two Ivanti Connect Secure flaws as the template. Parallax Nexus reported on a separate chain of three Ivanti zero-days earlier this month, one of them still unfixed.

BeyondTrust applied the patch to all Remote Support SaaS tenants on 9 October 2026, six days before the advisory. Self-hosted customers must apply the BT26-05-RS patch from the appliance interface unless they are subscribed to automatic updates, and anyone running a version older than 24.3.1 has to upgrade first. Mandiant's guidance goes past patching: it tells organisations to rebuild appliances of confirmed or unknown status from a clean image, because customers cannot audit the appliance host file system.

The honest reading is that the patch is the easy part and the credential rotation is the real bill. Mandiant watched the actor raise a compromised administrator account's Jump Item and team permissions from no access to administrator, then open remote support sessions to internal endpoints and pull software inventories off a user's desktop. Order matters: Mandiant says to patch or rebuild first, since rotating credentials while an attacker holds the appliance hands over the new ones. Scale is the open question. Mandiant describes evidence from one incident response engagement, not a population count, and because the actor deleted logs throughout, the exposure window cannot be read off the device.