CONNECT WITH US
Cyber Security

Cyber Security

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The Hacker News logo

Published on

Add as a preferred source on Google
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.

The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance.

"The vulnerability exists within internal components of Remote Support," BeyondTrust said in a Thursday alert. "The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance."

Patches for the flaw have been pushed to all Remote Support SaaS customers as of October 9, 2026. Self-hosted customers of Remote Support running versions from 24.3.1 through 26.2.3 are advised to manually update to BT26-05-RS patch. Customers running a version older than 24.3.1 will be required to upgrade to a newer version to apply the fix.

According to a timeline of events shared by BeyondTrust, Armory Castle is said to have exploited the flaw as a zero-day on a single self-hosted Remote Support appliance on August 29, 2026. Then, on September 27, 2026, "successful exploitation of another security device provider [became] public," it added, prompting it to initiate an investigation to hunt for similar activity.

Armory Castle has a history of exploiting zero-day vulnerabilities in Citrix NetScaler ( CVE-2023-4966 ) and Ivanti Connect Secure ( CVE-2023-46805, CVE-2024-21887 , and CVE-2025-0282 ) appliances to break a wide range of sectors, including legal services, SaaS providers, business-process outsourcers, technology, and governments, for long-term intelligence collection.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.