China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

A Chinese state-linked espionage group known as Armory Castle (formerly tracked as UNC5221 or Warp Panda) used an unpatched flaw in BeyondTrust Remote Support, CVE-2026-102764 with a CVSS score of 9.3, as a zero-day as far back as August 29, 2026. The bug stems from insufficient validation of message origin in an internal messaging component, letting attackers perform unauthorized file operations on the appliance. BeyondTrust has rolled out fixes to all SaaS customers and released the BT26-05-RS patch for self-hosted deployments running versions 24.3.1 through 26.2.3, while older installs must upgrade entirely. Google's Mandiant found that successful compromises led to installation of a PHP web shell called SAWFLY, credential theft, log wiping, and use of a custom SOCKS5 tunneler named BARECLAW to maintain covert, internet-facing access and pivot into downstream systems.