Overview
- Security teams say the zero-day CVE-2026-102764 was used in attacks that began on August 29, 2026, to gain initial access to at least one BeyondTrust Remote Support appliance.
- BeyondTrust pushed a fix to all Remote Support SaaS tenants on October 8–9, 2026, and released the BT26-05-RS patch for self-hosted customers who must apply it or upgrade.
- Mandiant and Google Threat Intelligence Group attribute the campaign to Armory Castle and report the group deployed a Sawfly PHP web shell and a Bareclaw SOCKS5 tunneler to escalate to root, harvest stored secrets and pivot to downstream systems.
- Researchers warn any internet-reachable appliance that ran a vulnerable version during the exploitation window should be treated as potentially compromised and note Shadowserver tracks roughly 1,400 exposed instances.
- Recommended defenses include preserving telemetry, blocking public access to appliances, redeploying compromised devices from clean images, rotating credentials in dependency order and applying the vendor patch immediately.