Late last week, identity management firm BeyondTrust disclosed a Critical vulnerability in its Remote Support platform, with what are thought to be PRC-backed threat actors already targeting the zero-day.
CVE-2026-102764, disclosed on October 15, has a CVSS score of 9.3 and impacts versions 0through 26.2.3 of BeyondTrust Remote Support.
“While our internal testing has not identified any way for an attacker to exploit this vulnerability in Privileged Remote Access, PRA shares the affected code, so out of an abundance of caution, we have released the patch for PRA and recommend self-hosted Privileged Remote Access customers apply it immediately,” BeyondTrust said in its advisory.
The company has been working with Google’s Mandiant team to analyse the threat activity, which first began in late August and continued into September. So far, only two of BeyondTrust’s customers have been impacted; however, Mandiant has identified overlapping TTPs with the Chinese espionage actor UNC5221, also known as Armory Castle.
“In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organisations before patches are deployed,” Mandiant said in a blog post.
“It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764.”
Once the hackers have established a foothold in their victim, they escalate privileges, move laterally, and deploy “newly identified custom malware”: the SAWFLY webshell and the BARECLAW tunneler.
The threat actor was also observed deleting appliance logs and other endpoint artifacts in order to evade detection.
Despite only two victims being identified so far, the US Cybersecurity & Infrastructure Security Agency is urging customers to act fast and patch to version 24.3.1 and later. The agency has already added CVE-2026-102764 to its Known Exploited Vulnerabilities Catalog.
Jake Knott, head of threat intelligence at cyber security firm watchTowr, outlined why BeyondTrust Remote Support is such a prime target for espionage activity.
“Remote Support is used to facilitate access into an organisation by design, which makes it an incredibly attractive target for attackers of any capability to find and exploit vulnerabilities in,” Knott told Cyber Daily.
“This is not the first time BeyondTrust has had these issues, with multiple prior vulnerabilities already on CISA's Known Exploited Vulnerabilities list. We expect the same types of attackers will keep coming back.”
Knott acknowledged that while technical details are currently limited, he expects the window between targeted exploitation and broad, indiscriminate exploitation in the wild to be short, “as the attention this vulnerability is receiving will drive rapid reverse engineering”.
“Organisations running self-hosted Remote Support instances should patch immediately, and investigate instances for any indicators of compromise that may suggest prior exploitation,” Knott said.
“Based on public reporting, some of the persistence leveraged in this campaign is designed to survive reboots and configuration resets, so patching alone is not enough.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
