Armory Castle exploited BeyondTrust Remote Support auth bypass CVE-2026-102764 since August

Google's threat intelligence group and Mandiant say a suspected China-linked actor, tracked as Armory Castle, has been exploiting a critical authentication bypass in BeyondTrust Remote Support appliances since late August 2026. The vulnerability, CVE-2026-102764, is documented in BeyondTrust advisory BT26-05 with a severity score of 9.3 and affects Remote Support 26.2.3 and earlier.

According to the vendor's timeline, SaaS customers were patched on 8 October 2026 and the flaw was disclosed publicly on 15 October. Self-hosted appliances get no equivalent protection unless automatic updates are enabled, which leaves many operators to patch by hand.

How the intrusion unfolded

Mandiant's account describes a compact escalation path. The actor used the authentication bypass to gain initial access, then moved from the appliance's web service account to root by copying the system shell to a fresh location and enabling the SUID permission bit. From there the attackers installed a PHP webshell dubbed Sawfly for command and control, used the appliance's own secrets utility to read stored credentials, and raised Jump Items to Administrator so remote sessions could be started against downstream systems on demand.

Two significant gaps remain in the public record. Neither BeyondTrust nor Google has said how many organisations were compromised, and the underlying root cause of CVE-2026-102764 has not been published.

Measuring exposure instead of victims

A technical write-up on dev.to approaches the scope question from the network side, using ZoomEye queries run on 23 October 2026. The results show how search-engine fingerprints can mislead. A title-based query for "BeyondTrust" returned 966 assets, while an application fingerprint for "BeyondTrust Remote Support" returned zero — a coverage problem in the fingerprint data, not proof that no appliances are online. A fingerprint for the sibling product, Privileged Remote Access, matched 226 assets.

The write-up also cites Shadowserver telemetry tracking more than 1,400 exposed BeyondTrust instances across the two product lines. The author is careful about what these figures mean: they measure reachability, not vulnerability, and none of them identifies a host that was actually exploited. Snapshots taken after disclosure also miss appliances that have since been patched or taken offline, and they include honeypots and unrelated pages that merely mention the vendor.

Practical steps for operators

The dev.to post lays out a triage sequence. Sweep external address ranges with a broad title query, then filter results against the organisation's own netblocks, certificates and DNS records. Cross-check what survives against configuration management data to confirm which appliances run 26.2.3 or earlier, patch them, and verify that automatic updates had not quietly been disabled. Restricting the /login and /appliance paths at the network edge — enforced at the firewall rather than on the appliance itself, with denials logged — shrinks the reachable surface.

The firmest recommendation concerns any appliance that was both reachable and vulnerable during the exploitation window. Mandiant's guidance, as relayed in the write-up, is to treat such an appliance as potentially compromised until it has been reviewed, and in practice to rebuild it from a clean image rather than attempt in-place cleaning. Review means inspecting memory and configuration, not simply applying the patch.

Why it matters

Remote support appliances are pivot points by design: whoever controls one controls sessions into the wider estate. In this incident the attackers reportedly harvested stored credentials and reached downstream systems with administrative rights, turning a single appliance compromise into a network-wide problem. The dev.to author notes this class of appliance has now been exploited three times in three years, and with no victim count published by the vendor or researchers, any organisation running a self-hosted instance from before the October patch has to assume it fell inside the window. Exposure scans cannot prove compromise, but they produce the artifact responders need first: a defensible list of which appliances the internet could actually reach.