Attackers Used an Unknown Flaw to Take Over BeyondTrust Remote Support Appliances
1An Attacker With No Login Gained Access to the Credentials Remote Support Keeps
A suspected China-linked espionage group broke into BeyondTrust Remote Support appliances in late August 2026, says Google's Mandiant team. The group used a zero-day, a flaw with no fix yet. BeyondTrust disclosed the flaw, CVE-2026-102764, on October 15, 2026. It lets an attacker with no login upload files to the appliance. Once inside, the group made itself root, the administrator account with full control of the appliance host. BeyondTrust's post on the attack describes such an appliance as "a credential source and a map of who connects to what."
After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset.
Google Threat Intelligence Group and Mandiant, ARMORY CASTLE Exploits BeyondTrust, October 15, 2026
IT teams use BeyondTrust Remote Support to access and troubleshoot the computers they look after. It runs as an appliance, either self-hosted or hosted by BeyondTrust, and stores the privileged credentials those sessions use. The flaw affects all supported versions up to 26.2.3.
According to BeyondTrust, the group hit two customers on August 29, one hosted by BeyondTrust and one self-hosted. The company has seen no activity from the group since August. BeyondTrust patched hosted customers automatically, though Mandiant says hosted customers should still rotate credentials and review their configuration. Self-hosted customers need the BT26-05 patch now. Mandiant tells organizations to prepare for wider exploitation now that the flaw is public. SolarWinds fixed a flaw in Access Rights Manager on September 17, 2026. IBM fixed 22 in Verify Identity Access on October 7.
2The Group Went for the Vault, Then Gave Itself Standing Access
Mandiant recovered the commands the group ran with the appliance's own secrets utility. The group tried the vault of one site service account first, then fell back to the appliance-wide password safe that holds the stored administrative credentials. Afterward the group deleted the utility's log. Mandiant's rotation list runs from administrator credentials and API client secrets to Security Assertion Markup Language (SAML) signing keys. It ends with any credential typed into a support session during the window. Mandiant also says to rotate only after patching, since new credentials set on an appliance the attacker still controls are exposed too.
The group then made its access last by raising one compromised account's permissions from No Access to Administrator. The change covered Jump Items, the downstream systems an account may open remote sessions on.
This configuration change granted the threat actor permanent, unrestricted authorization to launch remote sessions to downstream systems populated within the appliance's Jump Item list.
Google Threat Intelligence Group and Mandiant, ARMORY CASTLE Exploits BeyondTrust, October 15, 2026
Mandiant's hardening advice targets this change. The default Jump Item role in every group policy goes to No Access, with roles granted through policy rather than per user. API accounts get the minimum permission set and a named owner for any account that can manage users or Jump Items. Mandiant says these controls reduce exposure and limit the damage after a break-in. They do not replace the patch.
Source: Google Threat Intelligence Group and Mandiant, ARMORY CASTLE Exploits BeyondTrust, October 15, 2026.