BeyondTrust patches a Remote Support zero-day that suspected Chinese spies have exploited since late August

BeyondTrust told customers on Thursday to patch a critical flaw in its Remote Support product that attackers have exploited as a zero-day since late August. IT and customer support teams use Remote Support to troubleshoot systems remotely. The flaw, tracked as CVE-2026-102764, is an authentication bypass. It lets unprivileged remote attackers perform file operations on appliances running Remote Support 26.2.3 or earlier, BleepingComputer reports. BeyondTrust patched its Remote Support and Privileged Remote Access SaaS customers on October 8. Self-hosted installations without automatic updates have to be patched manually. BeyondTrust attributed the attacks to a suspected China-nexus espionage actor. Mandiant and Google Threat Intelligence Group track the group as "Armory Castle" (formerly UNC5221), and CrowdStrike tracks it as "Warp Panda." Mandiant researchers, who spotted the first attacks, say the hackers used the flaw to get in, then gained root privileges by enabling SUID permissions. They then installed the newly identified Sawfly web shell and Bareclaw tunneling malware and wiped logs. The Hacker News also reports that China-linked hackers used the flaw to take over remote support servers. Remote support appliances have privileged access to the systems they manage, which makes them valuable to espionage groups. Administrators of self-hosted instances should confirm they are patched and check for signs of compromise dating back to August.