A suspected Chinese espionage group used a previously unknown flaw in BeyondTrust Remote Support for about six weeks before a fix shipped, according to research Google published Thursday and SecurityWeek reported Friday. Because the product gives help-desk staff privileged remote control of corporate computers, Google is urging organizations that ran an exposed, unpatched appliance to assume it was compromised and to rebuild it rather than simply install the update.

What Happened

The flaw, tracked as CVE-2026-102764, sits in internal components of Remote Support that did not properly check where incoming messages came from, letting an attacker perform file operations on the appliance, according to the CVE record BeyondTrust filed Thursday. It affects versions through 26.2.3 and carries a severity score of 9.3 out of 10. No login or user action is needed to exploit it.

SecurityWeek reported that attacks began Aug. 29 against one BeyondTrust-hosted appliance and one run by a customer. BeyondTrust identified the defect Sept. 28, had a patch two days later and shipped it Oct. 8 after closing other exploitation paths. Sources differ slightly on the cloud rollout: BleepingComputer and Infosecurity Magazine give Oct. 8, while Google and a BeyondTrust statement quoted by SecurityWeek say all hosted Remote Support customers were patched as of Oct. 9. Self-hosted customers without automatic updates must apply the fix themselves, and those on versions older than 24.3.1 must upgrade first.

RelatedCISA Gives Agencies Three Days to Fix Exploited Ivanti VPN Flaw as Part of Attack Chain Stays Open

In its report, “ARMORY CASTLE Exploits BeyondTrust,” Google's Mandiant unit attributed the intrusions to a group it calls ARMORY CASTLE, formerly UNC5221, which it describes as a suspected China-nexus espionage actor active since at least October 2023. That attribution is Google's assessment; CrowdStrike tracks the same cluster as Warp Panda, BleepingComputer reported.

Google described a methodical intrusion. About 11 minutes after the first malicious request, a hidden web shell, a small program for issuing remote commands, appeared on the appliance. The attackers then planted a backdoor giving them full control of the appliance's operating system, dumped the appliance's stored credential vault, added persistence that survives reboots and configuration resets, and deleted logs. Using a stolen administrator account, they raised permissions, opened support sessions to internal computers and took documents such as software inventories.

CSO Online reported that BeyondTrust's alerts fired when the attackers escalated privileges, but an automated triage tool in a third-party detection platform closed them as false positives. The company contained its hosted instance 27 minutes after identifying it. Neither BeyondTrust nor Google has said whether other customers were breached.

Why It Matters

Remote access tools hold the keys to the enterprise. BeyondTrust says it serves more than 20,000 customers, including government agencies and 75% of the Fortune 100, BleepingComputer reported, and the Shadowserver Foundation tracks more than 1,400 of its remote support instances reachable from the internet.

Google's central advice changes the board-level question from “Did we patch?” to “Were we already inside?” The company wrote that any appliance reachable from the internet on a vulnerable version during the exploitation window “should be treated as potentially compromised until it has been reviewed.” It recommends preserving evidence, redeploying from a clean image and rotating credentials only after rebuilding, so new secrets are not exposed on a tainted system. CSO Online noted that Mandiant says credential rotation and configuration review apply to hosted customers too.

The product line has been a route into government before. Attackers attributed to China's Silk Typhoon used BeyondTrust flaws and a stolen API key to breach 17 hosted Remote Support instances, including the U.S. Treasury Department's, according to BleepingComputer.

What to Watch

Google expects the group may now exploit the flaw widely, as it did after 2024 disclosures of flaws in Ivanti's Connect Secure remote access software. As of Friday morning, the flaw was not in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, last updated Thursday before the disclosure; a listing would come with a federal remediation deadline. Also watch whether BeyondTrust or Google confirms additional victims.