Overview
- Security teams say the intrusion began on August 29, 2026, when a zero‑day in BeyondTrust Remote Support was used to gain initial access to at least one self‑hosted appliance.
- The bug, tracked as CVE‑2026‑102764 and rated CVSS 9.3, is an improper origin‑validation flaw in an internal messaging component that allows remote attackers to perform file operations on vulnerable appliances.
- Mandiant and Google GTIG report the actor escalated to root by creating a SUID shell, deployed a Sawfly PHP webshell and a Bareclaw SOCKS5 tunneler, harvested credentials with the bt‑secrets tool, deleted logs, and used stored Jump Items to pivot to downstream systems.
- BeyondTrust applied the fix to all Remote Support SaaS tenants on October 8–9, 2026 and released patch BT26‑05‑RS for self‑hosted instances, but researchers warn patched systems can still be compromised and recommend forensic review, credential rotation, redeployment from clean images, and strict network restrictions.
- Analysts note Armory Castle has a history of exploiting edge‑device zero‑days and that public disclosure often leads the group to broaden attacks, creating urgency for organizations and managed service providers to hunt for indicators and secure exposed appliances.