What happened
Mandiant identified exploitation by ARMORY CASTLE in late August 2026, before public disclosure. BeyondTrust had applied the patch to Remote Support SaaS tenants by October 9, 2026. On October 15, 2026, BeyondTrust disclosed CVE-2026-102764 in Remote Support. CVE-2026-102764 affects BeyondTrust Remote Support 26.2.3 and earlier; self-hosted versions 24.3.1 through 26.2.3 require the BT26-05-RS patch.
Mandiant observed exploitation evidence in access, syslog, messages, thin-scc, brain and SSL logs. Observed requests included POSTs to /app_84304470%2Ephp, and BARECLAW listened on TCP port 19800 through WebSocket path /uidchanarge. The actor used a webshell, copied a system shell to create a root-capable backdoor, targeted the appliance credential vault, changed administrative access and deleted logs.
The SAWFLY webshell used filename mangoapi.php with SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb, and the BARECLAW tunneller used filename ingredi_ws with SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462. Attribution posture: GTIG attributes the exploitation and deployment of SAWFLY and BARECLAW to the suspected PRC-nexus espionage actor ARMORY CASTLE.
Why this matters now
Remote Support is a privileged control plane rather than an ordinary web application. Host-level compromise can expose credentials stored or brokered by the appliance, change administrative permissions, launch support sessions and provide file-transfer access to downstream endpoints. That places help-desk operations, third-party support paths and privileged identity controls inside the incident boundary.
The actor deleted logs and used appliance-native capabilities, so patch status cannot answer whether earlier compromise occurred. Organisations need external firewall, reverse-proxy, WAF and SIEM evidence because local records may be incomplete. A clean patch on an appliance with persistent root access would reduce future exploitation without removing existing access or identifying stolen credentials.
The published filenames, hashes, request path and log sources provide an actionable hunt. The executive decision is whether evidence is sufficient to clear an appliance or whether uncertainty requires isolation and clean rebuild, followed by dependency-ordered credential rotation.
The decision for security leaders
Classify every internet-reachable vulnerable appliance as potentially compromised until evidence establishes otherwise. Assign incident response, privileged access, help-desk operations and application owners together because the appliance can bridge external access, administrative permissions, credentials and downstream endpoints.
Sequence response carefully: preserve external evidence, patch or isolate, determine whether the appliance can be cleared, rebuild where compromise is confirmed or unresolved, and rotate credentials only after attacker access has been removed. Rotating secrets while the appliance remains controlled can expose the replacements.
Require a documented downstream scope covering support sessions, Jump Items, file transfers, altered roles, API accounts, identity-provider integrations and every credential stored or entered during the exposure window. Closure requires evidence for each path, not a vendor patch receipt alone.
Evidence of closure
- Appliance patch record shows BT26-05-RS installed or vendor-managed SaaS coverage.
- SIEM search records disposition for published filenames, hashes, paths and log events.
- Clean rebuild evidence exists for any appliance with confirmed or unresolved host compromise.
- Credential rotation log covers vault, API, SAML, bind and integration secrets.
The Security.io assessment
The incident-response evidence is technically specific and supports high confidence that the documented actor obtained deep appliance control. It does not establish that every vulnerable instance was compromised, and the public record does not yet quantify the wider victim population. The cited article did not publish a public IP address or domain for the intrusion.
The central enterprise risk is control-plane trust. Remote Support can hold or broker credentials and initiate privileged sessions, so a compromised appliance can invalidate assumptions about vault separation, support-account governance and downstream endpoint integrity. The actor’s deletion of logs also raises the threshold for evidence-based clearance.
The public indicators are sufficient for immediate hunting, but absence of a match is not conclusive where local evidence may have been deleted. External telemetry, configuration comparison and session records carry more weight than a clean local scan. Unresolved host-level compromise should therefore remain an incident, not be administratively closed as a completed vulnerability ticket.
Questions for the morning meeting
- Which Remote Support appliances were internet-reachable while vulnerable?
- Can investigators access off-appliance logs covering the full exposure window?
- Which credentials and downstream systems were available through each appliance?
- Who can authorise isolation or rebuild when remote support operations are business-critical?