HighII Cyber Warfare & Critical Infrastructure16 October 2026, Friday
China-linked group exploited a flaw in BeyondTrust's remote support tool for weeks
Google and Mandiant disclosed that the CVE-2026-102764 flaw in BeyondTrust Remote Support had been exploited since 29 August by an espionage group linked to the Chinese state. A patch was released on 9 October; CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue.
According to a 16 October report by The Record, BeyondTrust confirmed Mandiant's assessment of the group as a Chinese state-sponsored espionage operation. Google tracks the group as Armory Castle; it was formerly known as UNC5221, is called Warp Panda by CrowdStrike and has been active since October 2023. The zero-day vulnerability, a flaw used in attacks before the vendor issues a patch, stems from internal components being unable to verify the origin of a message. Through it, an attacker can perform file operations on the device and escalate to root privileges.
According to Cybersecurity Dive, the attackers used 2 tools: a PHP web shell called Sawfly that provides encrypted command and control, and a SOCKS5 tunnelling tool called Bareclaw. The group left traces showing it had accessed all credentials stored on the device, targeted the secrets database and downloaded data through BeyondTrust's own file transfer service. Google's Kelli Vanderlee said the number of affected organisations was small for now. She added that other organisations may also have been compromised before the disclosure.
The group targets law firms, SaaS providers, business process outsourcing companies, technology firms and government agencies. The same group previously exploited zero-day flaws in Citrix and Ivanti's CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282. The patch went automatically to SaaS customers on 9 October. Under notice BT26-05, customers running their own servers must update manually. Mandiant recommends treating every vulnerable internet-facing device as compromised until it has been examined.
Talay assessment
Bottom line
The same group exploiting Ivanti, Citrix and now BeyondTrust in succession shows that China-linked espionage has chosen remote access devices at the network edge as a systematic entry point. The 41-day window between 29 August and 9 October shows defenders were dependent on logs, not patches. The most likely path is that the list of affected organisations grows among law and outsourcing firms in the coming weeks.
Likely effects
- Remote access vendorsNegative1–6 months
With edge devices from three different vendors hit in turn, customers face harder decisions on keeping these products internet-facing and on insurance assessments.
- Law and outsourcing firmsNegativeWeeks
The group targets law firms and business process companies that hold data for many clients; a single breach could cascade into wider data leaks.
- US–China cyber tensionNegativeWeeks
BeyondTrust confirming the Chinese state attribution adds to Washington's cyber file alongside the ceasefire talks.
Possibilities, ranked
- 1Victim list grows55%
New breaches are found among customers running their own servers, and notifications rise in the legal and SaaS sectors.
Watch: Additional indicators of compromise and organisational disclosures from Mandiant and CISA in October–November
- 2Incident stays contained30%
The patch is applied quickly, the number of affected organisations stays small and the case closes.
Watch: GTIG's update on the number of affected organisations
- 3New edge device flaw15%
Within a few weeks the group exploits a new zero-day vulnerability at another remote access vendor.
Watch: New edge device flaws added to CISA's Known Exploited Vulnerabilities catalogue
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- First exploitation▼ 29 August
- Patch▲ 9 October