Suspected State-Linked Hackers Exploited BeyondTrust Remote Support Flaw Before a Fix Existed

On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, affecting its Remote Support appliances (formerly Bomgar). The product lets IT teams securely access and troubleshoot remote devices. Successful exploitation allows an attacker to upload arbitrary files to the appliance.

During an incident response engagement, Mandiant found evidence that ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, used the flaw as a zero-day in late August 2026. After gaining access, the group escalated privileges, established persistent access and moved laterally. Mandiant says the actor showed deep knowledge of how BeyondTrust appliances work internally. It used newly identified custom malware, including the SAWFLY webshell and the BARECLAW tunneler, and routinely deleted appliance logs and endpoint artifacts to avoid detection.

Defenders should expect more attacks now that the flaw is public. Mandiant notes that ARMORY CASTLE and other threat actors have historically carried out broad, opportunistic exploitation after a vulnerability becomes known. Evidence of exploitation was found in several appliance log files, which sit in an encrypted partition. Mandiant strongly recommends affected organisations apply BeyondTrust's security patches immediately and review the additional guidance in BeyondTrust's own blog. This article covers only the opening of Mandiant's report, so the full post should be consulted for detailed guidance.