Suspected Chinese hackers exploited BeyondTrust zero-day since August, researchers say
A suspected Chinese state-backed spy group exploited an unknown flaw in BeyondTrust's Remote Support tool starting in late August, CyberScoop and The Record reported, citing Google's Mandiant. A patch is now out. Mandiant warned that more attacks could follow now that the flaw is public.
A suspected Chinese government-backed espionage group exploited a previously unknown flaw in BeyondTrust's Remote Support product in attacks that date to late August, CyberScoop and The Record reported. Mandiant, part of Google, calls the group Armory Castle and previously tracked it as UNC5221, according to CyberScoop and The Record. The flaw is tracked as CVE-2026-102764.
BeyondTrust publicly disclosed the flaw Thursday, CyberScoop reported. The company said the first known exploitation happened Aug. 29 and that it detected and contained the activity Sept. 28, according to CyberScoop. BeyondTrust released a patch for self-hosted customers Oct. 8 and updated its cloud product the same day, CyberScoop reported. The Record reported that a patch and several mitigations are available.
After exploiting the bug, the attackers escalated their privileges and moved across a victim's network, Mandiant said, according to The Record. They were able to get every credential the appliance stored and used custom malware that Mandiant calls Sawfly and Bareclaw, The Record reported. Mandiant warned that any vulnerable appliance reachable from the internet should be treated as potentially compromised until it is reviewed, according to The Record.
"We are aware of only a small number of impacted organizations at this time," Kelli Vanderlee, a senior analyst at Google Threat Intelligence Group, said in an email, according to CyberScoop. She said more organizations may have been hit before the disclosure. Mandiant warned organizations to "prepare for potential widespread exploitation," CyberScoop reported. A BeyondTrust spokesperson declined to say how many customers were compromised, CyberScoop reported.
The same group has exploited flaws in Ivanti products and Citrix NetScaler devices, CyberScoop and The Record reported. Its past targets include government, legal services, technology companies and software-as-a-service providers, The Record reported. The reports did not include a response from China's government.
What we know: Mandiant and BeyondTrust say a suspected Chinese spy group exploited the Remote Support flaw as a zero-day before a patch was released.
What we don't: How many organizations were breached and what data the attackers took.
Where outlets agree CyberScoop and The Record report that Mandiant tied attacks on a BeyondTrust zero-day to a suspected Chinese espionage group.
Where they differ The outlets cited here report the same key facts so far.