Organizations running self-hosted BeyondTrust Remote Support should treat exposed appliances as potentially compromised after a suspected Chinese espionage group exploited a critical zero-day to gain root control, access credential vaults, and establish footholds for lateral movement, according to Mandiant and Google Threat Intelligence Group.
“Organizations should prepare for potential widespread exploitation following this disclosure,” Google Threat Intelligence Group (GTIG) and Mandiant said in a blog post. The post attributes the zero-day exploitation to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, and dates it to late August.
BeyondTrust disclosed the flaw, CVE-2026-102764, the same day in advisory BT26-05 and said it had already released a patch on Oct. 8. According to the CVE record, it scores 9.3 on CVSS 4.0 and affects Remote Support versions up to 26.2.3. Mandiant said an unauthenticated attacker can exploit it to perform file operations, leading to host-level control and access to every credential the appliance stores or brokers.
