Critical Zero-Day Vulnerability Discovered in BeyondTrust Systems
BeyondTrust has issued an urgent warning to users of its Remote Support (RS) corporate service regarding a critical vulnerability. The flaw, tracked as CVE-2026-102764, has been exploited by attackers to gain unauthorized access to systems since late August. It allows for file manipulation without requiring authentication.
A Threat to Systems
The vulnerability affects Remote Support versions 26.2.3 and earlier. While BeyondTrust deployed a patch for its SaaS cloud service users on October 8, those hosting the system on their own servers must install updates manually. Experts advise that any internet-facing server lacking this security patch should be considered potentially compromised.
Cybersecurity researchers, including Mandiant and Google Threat Intelligence Group, have attributed these attacks to the hacker group "Armory Castle," formerly known as UNC5221. This state-sponsored group specializes in exploiting zero-day vulnerabilities in network equipment and corporate services.
How the Hackers Operated
According to Mandiant analysts, once inside the system, the hackers obtained "root"-level access, granting them total control over the server. The attackers utilized custom malware, such as Sawfly and Bareclaw, to conceal their tracks and delete log files. By leveraging stolen administrator credentials, they moved laterally through networks to access additional systems.
Armory Castle's activity has long concerned the security community, following similar tactics used against major companies like Ivanti and Citrix. BeyondTrust, which provides security services to over 20,000 clients—including 75% of Fortune 100 companies—remains a primary target for cybercriminals.
What This Means for Businesses
Although these attacks are global in scale, such incidents offer a vital lesson for businesses everywhere. Protecting corporate networks requires more than just perimeter security; it demands constant software updates and active system monitoring. If your organization utilizes BeyondTrust or similar remote support solutions, it is recommended that you immediately verify your software version against the latest security standards and ensure all necessary patches are installed.