BeyondTrust Remote Support flaw exploited by ARMORY CASTLE for espionage

What is BeyondTrust Remote Support and what happened?

BeyondTrust Remote Support (formerly Bomgar) is a tool used by IT teams to securely access and troubleshoot computers and servers from afar. On 15 October 2026, BeyondTrust disclosed a vulnerability tracked as CVE-2026-102764. This flaw allowed attackers to upload files to the device without permission. According to Google Threat Intelligence Group, the espionage group ARMORY CASTLE exploited this flaw as a zero-day in late August 2026, before the public knew about it. The incident was first spotted during an investigation by Mandiant, a well-known incident response firm.Google Threat Intelligence Group↗ (opens in a new tab)

How did the attackers break in and what did they do?

The attackers used the vulnerability to upload a malicious webshell called SAWFLY. A webshell is a small program that lets attackers run commands on a compromised server. SAWFLY used encryption and tricks to avoid detection, only responding to special requests. Once inside, the attackers escalated their privileges. They did this by copying the system shell to a new location and setting permissions so that anyone running it would have root (full) access. This gave them a persistent backdoor.

Next, ARMORY CASTLE tried to steal credentials from the device's built-in secrets vault. They used a BeyondTrust command-line tool to try different ways of dumping stored passwords, API keys, and endpoint credentials. After attempting this, they deleted the logs to cover their tracks.

To make sure they could keep control, the attackers created a script that would automatically grant their account passwordless root access every time the device restarted. This script checked if the account already had this access and, if not, updated the configuration to allow it.

Who is affected and what should they do?

Any organisation using BeyondTrust Remote Support appliances is at risk if they have not yet patched this vulnerability. The attackers had access to all credentials stored or handled by the device, which could include passwords for sensitive systems. BeyondTrust has released patches and guidance. Organisations should apply these patches immediately and review their systems for signs of compromise, especially by checking the encrypted log files mentioned in the advisory. Mandiant and Google recommend reviewing logs and following BeyondTrust's remediation steps.

What is known and what is not?

So far, only Google Threat Intelligence Group has reported on this incident, citing Mandiant's findings. There is no public information about which organisations were targeted or how many were affected. The full extent of the credential theft is also unclear. ARMORY CASTLE is described as a suspected China-linked espionage group, but there is no official attribution from governments or law enforcement.

What should defenders and IT teams do now?

Apply BeyondTrust's security patches for CVE-2026-102764 as soon as possible. Review logs for signs of the SAWFLY webshell and unusual privilege escalation activity. Check for unauthorised changes to sudoers files and startup scripts. If you find signs of compromise, rotate all credentials stored in the appliance and follow incident response best practices. Attackers may have deleted logs, so look for indirect signs of intrusion as well.