Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

China-Nexus Group Exploited BeyondTrust Remote Support Zero-Day to Hijack Appliances

A critical origin-validation flaw (CVE-2026-102764, CVSS 9.3) in BeyondTrust Remote Support was exploited as a zero-day from late August. Patch self-hosted 24.3.1–26.2.3 now and treat exposed appliances as potentially compromised.

4T4Tify Team4Tify
Oct 16, 2026·5 min read
China-Nexus Group Exploited BeyondTrust Remote Support Zero-Day to Hijack Appliances

BeyondTrust Remote Support Zero-Day (CVE-2026-102764) Used to Hijack Appliances

A critical flaw in BeyondTrust Remote Support — the remote-access platform formerly known as Bomgar — was quietly used as a zero-day weeks before a fix existed. Google Threat Intelligence Group (GTIG) and Mandiant link the activity to Armory Castle, a China-nexus espionage cluster previously tracked as UNC5221 / Warp Panda.

What happened

  • The bug. CVE-2026-102764 (CVSS 9.3) is an improper origin-validation issue in an internal messaging component of Remote Support. Messages are not properly checked for where they come from, which under the right conditions lets a remote attacker perform file operations on the appliance.
  • The timeline. According to BeyondTrust, the first known exploitation hit a single self-hosted appliance on 29 August 2026. After another security-vendor compromise became public on 27 September, BeyondTrust launched a hunt for similar activity and uncovered this one. SaaS customers were patched by 9 October 2026.
  • The intrusion chain. Per Mandiant, attackers dropped a lightweight PHP web shell (SAWFLY) with encrypted command-and-control, routing traffic through commercial VPN exit nodes and compromised home/small-office routers. From there they:
    • escalated to root by planting a SUID copy of the system shell disguised as /usr/bin/dbus-authd;
    • tried to pull passwords, API keys and endpoint credentials from the appliance's own secrets store via the bt-secrets utility;
    • abused configuration templates to give a service account passwordless root, keeping access across reboots;
    • used stolen admin credentials to open remote sessions to downstream systems in the Jump Item list and pull internal documents;
    • deployed BARECLAW, a custom C SOCKS5 tunneler, exposing it to the internet by editing the appliance's HAProxy config;
    • wiped system, web-server and application logs to hinder investigation.

Why it matters

Remote-support appliances hold the keys to an organization's estate: privileged credentials and one-click access to the endpoints they manage. Compromising one is effectively compromising everything it can reach.

The actor fits a familiar pattern. The same cluster has been tied to zero-day exploitation of Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282), hitting legal, SaaS, business-process outsourcing, technology and government targets. BeyondTrust warns that the group uses a zero-day selectively, then moves to mass exploitation of every unpatched instance once a flaw is public. The vendor also says its working assessment is that the actor pre-selects high-value products and keeps an AI-assisted model of them to build exploit chains — an assessment, not a confirmed finding, but a reason to expect faster weaponization.

What to do

  1. Patch now. Self-hosted Remote Support 24.3.1 – 26.2.3: apply the BT26-05-RS patch manually. Anything older than 24.3.1 must first upgrade to a supported release. SaaS tenants are already fixed.
  2. Assume exposure, then verify. GTIG/Mandiant advise that any appliance internet-reachable on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed.
  3. Hunt for the known artifacts: an unexpected /usr/bin/dbus-authd (especially SUID/root-owned), unknown PHP files in web directories, unusual changes to /ns/config/haproxy.conf, odd use of /ns/sbin/bt-secrets, unexplained startup-script or template changes, and gaps in logs.
  4. Rotate what the box could see. If compromise can't be ruled out, rotate credentials stored in or used by the appliance, and review session history for Jump Items accessed outside normal patterns.
  5. Shrink the exposure. Restrict the admin interface to trusted networks, forward appliance logs off-box so they can't be erased, and alert on new outbound tunnels.
  6. Know your edge. Edge and remote-access devices are this actor's favorite entry point — keep an up-to-date inventory of internet-facing appliances and their versions so you can act within hours, not weeks.

Reporting credit: this summary is based on coverage by The Hacker News (Ravie Lakshmanan, 16 Oct 2026), which draws on BeyondTrust's advisory and research from Google Threat Intelligence Group and Mandiant.

SHARE