Critical Zero-Day in BeyondTrust Remote Support Exploited by PRC-Backed Threat Actors
On October 15, identity management firm BeyondTrust disclosed a critical zero-day vulnerability (CVE-2026-102764) in its Remote Support platform, which has already been targeted by suspected Chinese state-backed threat actors. The flaw, rated 9.3 on the CVSS scale, affects versions 0 through 26.2.3 of the software.
BeyondTrust confirmed that while its Privileged Remote Access (PRA) product shares the affected code, no exploitation in PRA has been detected. However, the company released a patch for PRA as a precaution and urged self-hosted customers to update immediately to version 24.3.1 or later.
Google’s Mandiant team, assisting in the investigation, traced the initial exploitation attempts to late August and September. Only two BeyondTrust customers were confirmed as victims, but Mandiant linked the activity to UNC5221 (Armory Castle), a Chinese espionage group known for opportunistic exploitation of zero-days. The threat actor deployed custom malware SAWFLY (a webshell) and BARECLAW (a tunneler) while evading detection by deleting logs and endpoint artifacts.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-102764 to its Known Exploited Vulnerabilities Catalog, emphasizing the urgency of patching. Mandiant warned that, based on past behavior, UNC5221 may shift from targeted attacks to widespread exploitation now that the vulnerability is public.
Security experts, including watchTowr’s Jake Knott, highlighted the high-risk nature of Remote Support tools, which are designed to grant organizational access making them prime targets for espionage. BeyondTrust has faced prior vulnerabilities listed in CISA’s catalog, reinforcing concerns that threat actors will continue targeting the platform.
While technical details remain limited, researchers anticipate rapid reverse engineering, narrowing the window between targeted and indiscriminate exploitation. Organizations running self-hosted instances are advised to patch immediately and investigate for signs of compromise, as some persistence mechanisms in this campaign are designed to survive reboots and resets.
BeyondTrust cybersecurity rating report: https://www.rankiteo.com/company/beyondtrust
"id": "BEY1792376616",
"linkid": "beyondtrust",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '2 confirmed victims '
'(self-hosted customers)',
'industry': 'Identity Management / Cybersecurity',
'name': 'BeyondTrust',
'type': 'Company'}],
'attack_vector': 'Remote Support Software',
'customer_advisories': 'Update to version 24.3.1 or later; monitor for '
'unusual activity.',
'data_breach': {'data_exfiltration': 'Suspected (not confirmed)'},
'date_detected': '2023-08-01',
'date_publicly_disclosed': '2023-10-15',
'description': 'On October 15, identity management firm BeyondTrust disclosed '
'a critical zero-day vulnerability (CVE-2026-102764) in its '
'Remote Support platform, which has already been targeted by '
'suspected Chinese state-backed threat actors. The flaw, rated '
'9.3 on the CVSS scale, affects versions 0 through 26.2.3 of '
'the software. The threat actor deployed custom malware SAWFLY '
'(a webshell) and BARECLAW (a tunneler) while evading '
'detection by deleting logs and endpoint artifacts. The U.S. '
'Cybersecurity and Infrastructure Security Agency (CISA) added '
'CVE-2026-102764 to its Known Exploited Vulnerabilities '
'Catalog, emphasizing the urgency of patching.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Unknown (potential data exfiltration)',
'operational_impact': 'Potential unauthorized access to '
'organizational systems',
'systems_affected': 'BeyondTrust Remote Support (versions '
'0-26.2.3)'},
'initial_access_broker': {'backdoors_established': 'SAWFLY (webshell), '
'BARECLAW (tunneler)',
'entry_point': 'BeyondTrust Remote Support zero-day '
'(CVE-2026-102764)',
'reconnaissance_period': 'Late August - September '
'2023'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Remote support tools are high-value targets for '
'espionage; zero-days can shift from targeted to '
'widespread exploitation quickly; persistence mechanisms '
'may survive reboots/resets.',
'motivation': 'Espionage',
'post_incident_analysis': {'corrective_actions': 'Patch deployment; enhanced '
'monitoring for persistence '
'mechanisms; log integrity '
'checks.',
'root_causes': 'Zero-day vulnerability in Remote '
'Support software; exploitation by '
'PRC-backed threat actor UNC5221.'},
'ransomware': {'data_exfiltration': 'Suspected'},
'recommendations': 'Patch immediately to version 24.3.1 or later; investigate '
'for signs of compromise; monitor for further exploitation '
'attempts; enhance detection for log deletion and endpoint '
'artifacts.',
'references': [{'source': 'BeyondTrust Disclosure'},
{'source': 'Google Mandiant Investigation'},
{'source': 'CISA Known Exploited Vulnerabilities Catalog'},
{'source': 'watchTowr (Jake Knott)'}],
'regulatory_compliance': {'regulatory_notifications': 'CISA Known Exploited '
'Vulnerabilities '
'Catalog'},
'response': {'communication_strategy': 'Public disclosure, customer '
'advisories',
'containment_measures': 'Patch released (version 24.3.1 or '
'later), log deletion detection',
'incident_response_plan_activated': 'Yes',
'remediation_measures': 'Patch deployment, investigation for '
'compromise signs',
'third_party_assistance': 'Google’s Mandiant team'},
'stakeholder_advisories': 'Patch immediately; investigate for compromise '
'signs.',
'threat_actor': 'UNC5221 (Armory Castle)',
'title': 'Critical Zero-Day in BeyondTrust Remote Support Exploited by '
'PRC-Backed Threat Actors',
'type': 'Zero-Day Exploitation',
'vulnerability_exploited': 'CVE-2026-102764'}