Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

Google's Mandiant and GTIG report that Armory Castle, a Chinese state-backed espionage group also known as UNC5221 or Warp Panda, has been abusing a BeyondTrust Remote Support flaw as a zero-day since August 29, well before it was publicly disclosed. The bug, CVE-2026-102764 (CVSS 9.3), stems from poor validation of message origin and lets attackers perform file operations on RS appliances; all versions up to 26.2.3 are impacted. BeyondTrust only learned of the issue on September 28 and finished rolling out the BT26-05 fix on October 8, after extra testing to close additional exploitation routes; SaaS tenants are already patched, while self-hosted customers on 24.3.1–26.2.3 must apply it manually. Once inside, the attackers planted the Sawfly PHP webshell and the Bareclaw SOCKS5 tunneler, wiped logs, grabbed root and admin credentials, and used built-in support features to pull sensitive files and move laterally — tactics consistent with the group's past zero-day campaigns against Citrix NetScaler, Ivanti Connect Secure and Dell RecoverPoint.