China-linked threat group Armory Castle targeted BeyondTrust Remote Support using an undisclosed vulnerability tracked as CVE-2026-102764.
The 9.3-severity flaw permitted remote file manipulation, enabling attackers to deploy web shells and harvest database credentials.
BeyondTrust has released manual patches for self-hosted versions 24.3.1 to 26.2.3 and automated cloud updates.
What do we know about the attack?
The issue was reported in late August 2026. On August 29, Armory Castle attacked a device managed by the user himself. There is no indication that other organizations' systems were compromised.
According to BeyondTrust, the issue allowed someone to remotely make changes to files on the device because the software did not properly check where certain messages came from.
How did the perpetrators move?
After accessing the device, the attackers installed SAWFLY, a small program that allowed them to connect remotely and communicate using encryption. They also used commercial services to hide the origin of their connections, as well as routers that they had hacked into homes or businesses.
READ ALSO
Telecom provider breach exposes data on 500 security systems
They changed the settings that determine who has control over the device. They also tried to find passwords in its database and used compromised administrator credentials to examine and remotely connect to internal systems. To make it harder to track them down, they systematically deleted files that recorded the device's activity.
The Google Threat Intelligence Group and Mandiant participated in the analysis and detection of this activity.
What updates are needed?
BeyondTrust cloud service subscribers had received the fixes by October 9, 2026.
Those who manage their own systems should check which version they are using:
- Versions from 24.3.1 to 26.2.3: They need to manually install the BT26-05-RS update.
- Versions older than 24.3.1: They need to upgrade to a newer version of the software.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)