A Chinese state-backed group spent seven weeks inside BeyondTrust's privileged access management appliance before anyone noticed. When IT teams rebooted a compromised box believing they had evicted the attacker, the backdoor rebuilt itself from a poisoned boot script. According to Google's Threat Intelligence Group and Mandiant, the flaw tracked as CVE-2026-102764 let an unauthenticated attacker upload files to the appliance, then reach root and drain the credential vault.
Jump to what we checked on our own credential storage if you run any tool that centralizes passwords for other systems.
Why a Privileged Access Management Appliance Breach Spreads Everywhere
BeyondTrust Remote Support exists to be the single broker of privileged credentials across an organization's servers, network devices, and applications. That design is the point of a PAM tool, and it is also why compromising one is categorically worse than breaching any single server it manages. Per Google's GTIG and Mandiant, the attackers, tracked as ARMORY CASTLE and previously known as UNC5221 or Warp Panda, used BeyondTrust's own bt-secrets command-line utility to extract the full credential vault once they had root, then deleted the logs that would have shown the extraction happened.
The entry flaw itself, an authentication bypass by spoofing in the appliance's internal messaging component, let attackers upload arbitrary files without ever authenticating. Within roughly 11 minutes of weaponizing it, GTIG documented the attackers deploying a PHP webshell that returns a plain 404 to any request missing a specific hidden parameter, making it invisible to vulnerability scanners that don't already know it is there.
The Backdoor That Rebuilds Itself on Every Reboot
The detail that makes this breach unusually hard to clean up is the persistence mechanism. The attackers planted a startup script inside BeyondTrust's own boot-time execution directory that checks, on every system start, whether their passwordless root entry still exists in the sudoers configuration template, and re-adds it if it has been removed.
The script then forces the appliance to regenerate its live sudoers file from that poisoned template. An administrator who edits sudoers directly to remove the backdoor has changed nothing that survives the next reboot, because the appliance rebuilds the file itself. Mandiant's own guidance, per their technical writeup, is not to attempt to clean a suspected appliance at all, but to rebuild it from a known-good image instead.
The attackers also deployed a custom SOCKS5 tunneler bound only to localhost, reachable through a single obscure path routed in through the appliance's own legitimate reverse proxy, so no external scan of the appliance's open ports would ever reveal the tunnel.
What We Checked on Our Own Credential Storage
We audited every place at Krova Cloud where a credential for one system is allowed to unlock access to several others, the exact blast-radius shape this breach exploited. We found one internal deployment tool holding SSH keys for every customer VM host in a single config file with no rotation policy. We moved those keys to short-lived, scoped credentials issued per deployment instead, so no single compromised file can reach every host at once.
What to Check in Your Own Environment
- Confirm whether your BeyondTrust Remote Support instance, self-hosted or SaaS, is running patch BT26-05 or later, since self-hosted appliances without automatic updates were not patched by BeyondTrust's own rollout.
- Treat any appliance that showed anomalous privilege-escalation alerts between late August and mid-October as compromised rather than clean, since BeyondTrust's own sensors fired on this activity in real time and a third-party triage platform dismissed the alerts as false positives for nearly three weeks.
- If you suspect compromise, rebuild the appliance from a clean image rather than removing the backdoor's files or sudoers entry manually, because the persistence mechanism regenerates itself from a template that survives both a reboot and a configuration reset.
- Review whether any single credential store in your environment, PAM tool or otherwise, holds standing access to every other system you run, and whether that store is reachable from the internet at all.
The verdict here isn't that centralizing credentials in a PAM tool was the wrong call. It is still better than passwords scattered across spreadsheets and shell scripts, which has its own obvious downside. The catch is that centralizing access also centralizes the consequence of a single flaw.
A flaw in the broker itself turns one appliance into every credential it was trusted to protect. That isn't a hypothetical weakness, either: per Mandiant, this same category of product has already been breached this way twice before. A third-party triage platform dismissing a real alert here shows that even dedicated monitoring doesn't guarantee a fast catch.
This is the same shape as the ConnectWise vendor credential breach I wrote up two posts ago: standing, broadly trusted access is worth more to an attacker than any individual password, and it keeps being the actual foothold long after the headline vulnerability gets patched.
The Rule
A privileged access management appliance is designed to be trusted by everything it touches, which means a flaw in the appliance itself inherits that trust automatically, no additional exploitation required. If your incident response plan for a PAM compromise is "patch it and reboot," read the sudoers persistence trick above again: a reboot is exactly what let this backdoor prove its own durability, not what removed it.
Frequently Asked Questions
What is CVE-2026-102764?
An authentication bypass by spoofing flaw (CWE-290) in BeyondTrust Remote Support's internal messaging component, letting an unauthenticated attacker upload arbitrary files to the appliance. It carries a CVSS v4.0 score of 9.3 and affects all supported versions up to 26.2.3.
How long was this zero-day exploited before it was patched?
Exploitation began August 29, 2026. BeyondTrust did not discover the intrusion until late September, after a separate unrelated vendor incident prompted internal threat hunting. A patch, BT26-05, shipped October 8, and the CVE was publicly disclosed October 15, a roughly seven-week silent window.
Why can't I just remove the backdoor and reboot the appliance?
The attackers' persistence script regenerates the poisoned sudoers configuration from a template every time the appliance boots, so manually deleting the backdoor's files has no lasting effect. Mandiant recommends rebuilding the appliance from a clean image instead of attempting in-place cleanup.
Who is behind this attack and have they targeted PAM tools before?
Google's GTIG and Mandiant attribute the campaign to ARMORY CASTLE, a Chinese state-backed group previously tracked as UNC5221 or Warp Panda. A separate Chinese group, Silk Typhoon, previously exploited two other BeyondTrust zero-days to breach the US Treasury Department, making this the second distinct state-backed campaign against this product line.
I'm Rohit, founder of Krova Cloud: disposable VMs with no central credential vault anyone can drain, because nothing on the box lives long enough to be worth draining. More debugging stories at debugly.dev.
Top comments (0)