- Google's threat team says suspected China-linked group ARMORY CASTLE exploited BeyondTrust flaw CVE-2026-102764 as a zero-day in late August 2026.
- The attackers reached root on the appliance, tried to dump stored credentials and used its built-in tools to reach an internal endpoint.
- Check for Remote Support versions up to 26.2.3, apply the BT26-05 patch, and review the encrypted log partition for signs of compromise.
The most valuable computer in a company is not always the one with the most data. Sometimes it is the one that holds the keys to everything else. A remote-access appliance is that kind of machine. IT staff use it to reach laptops and servers. So it stores or brokers the passwords that open them.
That is why a new report from Google Threat Intelligence Group matters to anyone who funds security. On October 15, BeyondTrust disclosed CVE-2026-102764. It is a flaw in its Remote Support appliances, formerly sold as Bomgar.
Google's analysts found evidence that ARMORY CASTLE exploited it in late August 2026, before any fix existed. They suspect the group works for China. A flaw used that way is called a zero-day.
What the attackers did, step by step
Mandiant, Google's incident response arm, found the intrusion during an incident response engagement. The flaw lets an unauthenticated remote attacker upload files to the appliance. Google's report says every supported Remote Support version up to 26.2.3 is affected.
The attackers sent POST requests to a file on the appliance. Mandiant could not recover that file. About 11 minutes later, the system logged a new webshell. The report calls it SAWFLY. A webshell is a small script that lets an attacker run commands through a web server.
SAWFLY ran as an ordinary user with limited rights. So the attackers needed more power. They copied the system shell to a new file and set it to run as root. Root means full control of the machine.
They then wrote a startup script. It added a passwordless-root rule to a configuration template. The appliance rebuilds its settings from that template. So the access survived reboots and configuration resets.
From one box to the whole network
Full control of the host put every secret the device keeps or hands out within the attackers' reach. Mandiant saw them run the appliance's own secrets tool. They tried several command variations to dump the credential vault. Then they deleted the tool's log.
Next they signed in to the admin portal with compromised Administrator credentials. They then changed that account's settings. Its access to Jump Items and Teams went from none to full administrator. Jump Items are the systems listed for remote access.
The attackers then opened a remote support session to an internal endpoint. They used the built-in file transfer to pull documents, such as software inventories.
The lesson here is about what happened after the foothold. Much of the scouting and lateral movement used the product's own features: its permissions, its sessions and its file transfer. A tool built to give trusted staff reach became the attackers' reach.
A hidden door, and thin visibility
The attackers also ran a tunneler called BARECLAW. It relays network traffic through the appliance. They edited the appliance's HAProxy settings. HAProxy is the reverse proxy that forwards incoming requests to internal services.
The edit sent requests for one URL path to BARECLAW on a local port. That port could only be reached through this route. Mandiant says this hid the listener from external network scans.
The attackers also deleted system, web server and application logs. The report says the key evidence sat in log files on an encrypted partition under the /home directory. A team that only watches the network around an appliance may not see inside it.
What the report does not say
The report describes one incident response engagement. It does not say how many organizations were hit. Attribution is also a judgment. Google calls ARMORY CASTLE a suspected PRC-nexus actor. It says the tools match the group's earlier activity.
Google says the group has been active since at least October 2023. It says the group has hit edge appliances before. In 2024, CVE-2023-46805 and CVE-2024-21887 became public. Google then saw the group exploit them widely.
Google says defenders should prepare for a repeat here. That is the team's assessment, not an observed fact.
Questions to put to your team this week
First, do we run Remote Support, and which version? Anything up to 26.2.3 is affected. The report names BeyondTrust's BT26-05 patch.
Second, was the appliance reachable from the internet? Google's report treats that as a key exposure question.
Third, who can inspect the encrypted log partition? Patching closes the door. It does not show who already walked through.
Fourth, which credentials did the appliance hold? If there is any sign of compromise, treat them as candidates for rotation. Read BeyondTrust's own guidance for specifics.
A remote-access appliance is a master key cabinet with a web interface. It deserves the same monitoring and patching discipline as the systems it unlocks.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Google Threat Intelligence Group.
