Chinese state hackers hid reboot-surviving backdoor in BeyondTrust PAM appliance

A seven-week foothold in a privileged access broker

A Chinese state-backed hacking group kept covert access to BeyondTrust's Remote Support appliance for roughly seven weeks, using a zero-day flaw to reach root and empty the credential vault the product exists to protect. According to Google's Threat Intelligence Group (GTIG) and Mandiant, whose findings are summarized in a technical writeup published on dev.to, the intrusion began on August 29, 2026 and went unnoticed until late September, when an unrelated vendor incident prompted internal threat hunting at BeyondTrust.

The initial foothold came through CVE-2026-102764, an authentication bypass by spoofing flaw in the appliance's internal messaging service. The bug, which carries a CVSS v4.0 score of 9.3 and affects supported versions up to 26.2.3, let an unauthenticated attacker upload arbitrary files to the appliance. GTIG documented that within about 11 minutes of weaponizing the flaw, the attackers deployed a PHP webshell that returns a plain 404 to any request missing a specific hidden parameter — so scanners that do not already know its signature see nothing.

GTIG and Mandiant attribute the campaign to ARMORY CASTLE, a Chinese state-backed group previously tracked as UNC5221 or Warp Panda. Once the attackers had root, they used BeyondTrust's own bt-secrets command-line utility to extract the entire credential vault, then deleted the logs that would have recorded the extraction.

Persistence that survives a reboot

What most distinguishes this incident is the persistence mechanism. The attackers planted a startup script inside BeyondTrust's own boot-time execution directory. On every system start, that script checks whether a passwordless root entry still exists in the sudoers configuration template, re-adds it if it has been removed, and then forces the appliance to regenerate its live sudoers file from the tampered template.

The practical effect is that manual cleanup is futile: an administrator who edits the live sudoers file has changed nothing that survives the next reboot. Mandiant's guidance is to skip in-place remediation entirely and rebuild a suspected appliance from a known-good image.

The attackers also installed a custom SOCKS5 tunneler bound only to localhost, reachable through a single obscure path routed in via the appliance's own legitimate reverse proxy. Because the tunnel never opens an external port, an outside scan of the appliance would not reveal it.

Alerts fired, then got dismissed

Detection was less a failure of tooling than of process. The writeup reports that BeyondTrust's own sensors flagged the anomalous privilege-escalation activity in real time, but a third-party triage platform dismissed those alerts as false positives for nearly three weeks.

Patching also left gaps. BeyondTrust shipped a fix, BT26-05, on October 8 and publicly disclosed the CVE on October 15, but self-hosted appliances without automatic updates were not covered by the vendor's rollout and required manual action.

Why it matters

A privileged access management appliance is trusted by every system it brokers credentials for, which means a flaw in the appliance inherits that trust automatically, with no further exploitation required. Per Mandiant, this product category has been breached in this way more than once: a separate Chinese group, Silk Typhoon, previously exploited two other BeyondTrust zero-days to breach the US Treasury Department, making this the second distinct state-backed campaign against the product line.

Two lessons stand out. First, "patch it and reboot" is not a valid incident response plan for this class of compromise — in this case a reboot was exactly what demonstrated the backdoor's durability rather than removing it. Second, centralizing credentials in a PAM tool is still more defensible than scattering passwords across spreadsheets and scripts, but it centralizes consequence along with access: one appliance flaw can expose every credential it was trusted to protect.

What operators should check

Administrators running BeyondTrust Remote Support, self-hosted or SaaS, should confirm they are on patch BT26-05 or later, and treat any appliance that produced anomalous privilege-escalation alerts between late August and mid-October as compromised rather than clean. Where compromise is suspected, rebuild from a clean image instead of deleting the backdoor's files or sudoers entries by hand. More broadly, the writeup recommends reviewing whether any single credential store in an environment holds standing access to every other system, and whether that store is reachable from the internet at all.