Suspected Chinese state-backed group exploits new BeyondTrust remote support flaw

BeyondTrust, Mandiant and Google Threat Intelligence Group have confirmed a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support appliances, which IT teams use to access and troubleshoot remote devices. The flaw is being exploited by a group Mandiant calls Armory Castle or UNC5221, which BeyondTrust describes as a Chinese state-sponsored operation focused on long-term intelligence collection. A patch has been released and several mitigations are available. Other security firms have since confirmed exploitation.

According to Mandiant, the attackers escalated their privileges after exploiting the bug, moved through victim networks and established a deeper foothold. They used custom malware named Sawfly and Bareclaw, and showed a detailed understanding of how the appliances work. They were able to obtain every credential stored on the appliance and modify files that survive reboots and configuration resets. BeyondTrust traced the exploitation back to August 29.

BeyondTrust says the group's documented targets include legal services, SaaS providers, business-process outsourcers, technology companies and government. Researchers believe it targets technology firms to help find other zero-day flaws. The group has previously exploited vulnerabilities in popular edge devices. Mandiant advises that any vulnerable appliance reachable from the internet should be treated as potentially compromised until it has been reviewed.