China-Linked Hackers Exploited Beyond Trust Zero-Day to Take Over Remote Support Servers
Summary: The China-nexus group Armory Castle (previously UNC5221 or Warp Panda) exploited CVE-2026-102764, a CVSS 9.3 improper origin validation flaw in BeyondTrust Remote Support's internal messaging component, as a zero-day on a single self-hosted appliance on August 29, 2026. BeyondTrust pushed patches to SaaS customers by October 9, 2026, and directed self-hosted customers on versions 24.3.1 through 26.2.3 to update to BT26-05-RS, while CISA added the flaw to its KEV catalog on October 16, 2026 with an October 19 deadline for FCEB agencies.
Key Takeaway: Mandiant reported that compromise leads to a PHP web shell called SAWFLY, full administrative control of the appliance, and theft of stored secrets used to reach downstream systems - and BeyondTrust's own assessment is that once a flaw goes public, this actor moves to broad exploitation of every instance still unpatched.