Chinese state hackers exploited BeyondTrust zero-day flaw for seven weeks

Tech Times reported that a Chinese state-backed espionage group exploited a critical vulnerability in BeyondTrust Remote Support software for seven weeks before its public disclosure. The security flaw allowed attackers to drain enterprise credential vaults and install a reboot-surviving backdoor on privileged access management appliances. [1]

The vulnerability is designated as CVE-2026-102764. Tech Times reported that the flaw was publicly disclosed on October 15, 2026, but active exploitation had been occurring since August 29. Once inside an appliance, the attackers used its internal architecture to access all connected systems managed by that appliance. As FTMQ Security reported earlier, the flaw allows unauthorized file operations because the software fails to confirm message origins, granting attackers root control. [1][5][6]

A zero-day is a computer vulnerability unknown to developers or parties capable of mitigating it, leaving it open to exploit until fixed. As FTMQ Security reported earlier, the espionage group Armory Castle deployed custom backdoors and stole credentials during the campaign, using the compromise to establish footholds for lateral movement. [3][5][6]

Patches are currently available for the affected software. Tech Times reported that more than 1,400 self-hosted Remote Support appliances remain potentially affected. As FTMQ Security reported earlier, security analysts advise organizations running self-hosted appliances to treat exposed systems as potentially compromised. [1][5][6]