China nexus hackers exploit zero day flaw in BeyondTrust support software

A suspected China-nexus hacker group tracked as Armory Castle has been exploiting a zero-day vulnerability in BeyondTrust Remote Support since late August, Cybersecurity Dive reported on Thursday citing Google Threat Intelligence Group. The attackers have leveraged administrative access in the support tool to deploy custom backdoors, harvest credentials, and steal sensitive data for reconnaissance. [1]

The critical security flaw is tracked as CVE-2026-102764, according to Cybersecurity Dive. The flaw stems from internal components of Remote Support failing to verify the origin of incoming messages, which allows an attacker under specific conditions to perform unauthorized file operations on an affected appliance. [1]

As FTMQ Security reported earlier, attackers exploited CVE-2026-102764 to gain root access to affected devices. The hackers used this access to compromise credential vaults and create initial footholds for lateral movement inside target networks. Organizations running self-hosted appliances were advised to treat exposed systems as potentially compromised. [5]

BeyondTrust was formed following Microsoft's acquisition of policy management assets from DesktopStandard Corporation in October 2006. The retained software was renamed Privilege Manager to focus on enterprise security by enforcing least-privilege access and reducing privilege escalation risks. [4]