What happened
On 15 October BeyondTrust disclosed CVE-2026-102764, a flaw in its Remote Support (formerly Bomgar) appliances that allows arbitrary file upload. In its write-up, Google’s Mandiant team says a suspected PRC-nexus espionage actor, ARMORY CASTLE, used the flaw as a zero-day in late August 2026. After getting in, the actor planted a webshell, gained root, tried to dump the appliance’s credential vault and deleted logs.
Why it matters
A remote support appliance is a trusted route into many machines. If it is compromised, the attacker may reach every credential it stored or brokered, according to Mandiant. That makes it a bigger problem than one more patch on a server.
Small teams are exposed in a particular way. The appliance is often set up once, sits at the edge and is rarely looked at again. Mandiant also warns that, historically, this actor and others have moved to broad, opportunistic exploitation once a flaw becomes public. So the window between disclosure and mass scanning may be short.
Log deletion matters too. The actor routinely removed appliance logs and endpoint artefacts, so a clean-looking log does not prove a clean system.
What to do this week
- Find out whether you run BeyondTrust Remote Support, including any appliance a vendor or IT provider manages for you.
- Apply the patches BeyondTrust has provided, and read their own advisory as well as the Mandiant post.
- Do not stop at patching. The exploitation began before disclosure, so assume an unpatched appliance could already have been touched and ask whether it was reachable from the internet in late August or after.
- Review the indicators Mandiant lists, such as unexpected files in the web root, odd POST requests and a copy of a shell with elevated permissions placed in a system directory. Use the full post for the exact details.
- If you find anything suspicious, or cannot rule it out, rotate the credentials, API keys and endpoint passwords the appliance held, and send logs to a separate system so they cannot be wiped from the box.
Need a hand?
If you are unsure whether your remote access tooling is exposed, or you want a second opinion on what to rotate and monitor, our Security & Compliance work covers exactly this. The first call is free and it is with an engineer, not a salesperson.
Source: ARMORY CASTLE Exploits BeyondTrust
Related service: Security & Compliance