The critical BeyondTrust Remote Support zero-day vulnerability CVE-2026-102764 was disclosed, and an APT suspected of being ARMORY CASTLE exploited the vulnerability before remediation and moved laterally to internal endpoints.
On 15 October 2026, US-based BeyondTrust disclosed the serious Remote Support vulnerability CVE-2026-102764. Investigations by GTIG and Mandiant found that the threat actor ARMORY CASTLE, suspected of having links to China, had been exploiting the vulnerability as a zero-day since late August and was believed to have moved laterally to internal endpoints after gaining access to an appliance.
The attackers installed a web shell on the appliance and attempted privilege escalation and credential theft, then used legitimate remote-support functionality to connect to internal endpoints. Changes to Jump Items permissions and the exfiltration of files to understand the internal environment were also confirmed. The attackers also attempted to relay communications using their proprietary tunnelling tool BARECLAW and delete traces of the intrusion.
The BT26-05-RS patch was provided for versions 24.3.1–26.2.3. Guidance was issued for self-hosted deployments to confirm that the patch had been applied and to update where it had not. The SaaS environment was said to have been remediated by 9 October 2026. The PR stated that PRA also contains common code, but that no exploitation had been confirmed at that time.
The incident progressed from the start of exploitation in August to public disclosure in October. Containment and reproduction of the breach indicators were reported only after detection through threat hunting. BeyondTrust is urging organisations not to rely solely on automated determinations of high-severity alerts and to review vulnerability-management and patching practices on the assumption that lateral movement may occur.