Google identifies China-linked exploitation of BeyondTrust security flaw

Google has warned that a suspected China-linked espionage group exploited a critical vulnerability in BeyondTrust remote support systems, gaining privileged access and establishing mechanisms to remain inside compromised networks.

The vulnerability, designated CVE-2026-102764, was disclosed on 15 October after investigators identified attacks dating to 29 August. Google’s Threat Intelligence Group and its Mandiant division attributed the activity to Armory Castle, previously tracked as UNC5221, and warned that public disclosure could trigger wider exploitation against unpatched installations.

BeyondTrust said the flaw affects Remote Support software through version 26.2.3 and carries a critical severity rating of 9.3. It allows an unauthenticated remote attacker to conduct unauthorised file operations, potentially upload malicious files and ultimately take control of an affected appliance.

The company released corrective updates on 8 October and said its hosted customers had received protection by 9 October. Organisations operating their own installations must ensure the BT26-05-RS patch has been installed. Older deployments require an upgrade before the patch can be applied.

BeyondTrust confirmed that the attackers exploited one company-hosted Remote Support instance and one customer-operated appliance on 29 August. Its security team discovered suspicious activity affecting the hosted instance on 28 September and contained it within 27 minutes of detection. Mandiant subsequently shared findings from its investigation of the separately managed appliance.

Google’s investigators said the attackers used the vulnerability to install a custom webshell called SAWFLY, which enabled covert communications and execution of commands. They then elevated their access to root privileges, obtaining extensive control over the appliance and its underlying operating system.

The intruders also attempted to extract passwords and other secrets through a proprietary BeyondTrust administrative utility. Investigators observed commands directed at both account-specific and appliance-wide credential stores, followed by efforts to erase logs recording the activity.

Using compromised administrator credentials, the attackers accessed the Remote Support management interface and changed permissions to obtain lasting access to systems listed for remote support. They subsequently launched sessions into internal endpoints and used legitimate file-transfer capabilities to retrieve documents, including software inventories useful for mapping the victim’s network.

A second custom tool, BARECLAW, provided a tunnelling capability that could relay network traffic through the compromised appliance. Investigators found changes to internal routing configurations that helped conceal the mechanism from external scanning. The attackers also removed logs and other evidence, complicating efforts to reconstruct their movements.

Google said the combination of specialised malware, credential theft and manipulation of native administrative functions demonstrated detailed knowledge of BeyondTrust systems. Such access is particularly sensitive because remote support appliances can connect to numerous endpoints and may hold credentials needed to administer them.

The company assessed with high confidence that Armory Castle would continue exploiting previously unknown vulnerabilities in internet-facing equipment for espionage. It cautioned that the group had previously expanded attacks after vulnerabilities became public, although it did not establish that a comparable widespread campaign was already under way against this flaw.

BeyondTrust said its assessment of the group’s China connection was based on operational methods and was consistent with Mandiant’s findings. The company described its confidence as moderate to high. Attribution therefore remains an intelligence assessment rather than independently established proof of direction by Beijing.

The vendor has withheld detailed technical information about the vulnerability while customers complete updates, saying disclosure of exploitation specifics could increase exposure. It also recommended precautionary patching for Privileged Remote Access products, which share affected code, although its testing had not identified an exploitable route in that product.

Mandiant advised organisations with internet-accessible vulnerable appliances to investigate possible compromise rather than assume installation of a patch removes an existing intrusion. Its guidance calls for reviewing available appliance logs, credentials and configuration changes, alongside assessing whether attackers used support sessions to reach connected systems.

BeyondTrust said the initial investigation involved coordination between its internal security teams and outside researchers. The company reproduced the attack method by the evening of 28 September, allowing engineers to begin developing a fix. It said the interval before publication was used to test the correction and give customers time to secure their systems before technical details became more widely available.

The researchers said potentially useful forensic records include access, system and application logs held within an encrypted partition of the appliance. Access to those records may require specialised investigation procedures, particularly where an attacker has already attempted to delete evidence.