Hackers exploit BeyondTrust zero day vulnerability to hijack remote servers

A China-linked espionage group exploited a zero-day vulnerability in BeyondTrust Remote Support software in late August 2026, according to reports from The Hacker News, SOC Prime, and CSO Online. Dark Reading reported that BeyondTrust joined other vendors, including Ivanti, Cisco, and Palo Alto Networks, in having edge device vulnerabilities targeted by attackers. [1][2][3][4][6]

The zero-day security flaw is tracked as CVE-2026-102764, SOC Prime, SOCRadar, and Cyber Kendra reported. The Hacker News stated that the espionage group carrying out the attacks is known as Armory Castle, which was previously tracked as UNC5221 or Warp Panda. [2][4][5][7]

CSO Online reported that Mandiant and Google observed a suspected Chinese espionage group using the flaw to gain root control, access credential vaults, and establish footholds for lateral movement. CyberSecurityNews also reported that the attackers exploited the vulnerability to gain root access and deploy backdoors on affected systems. [6][9]

CSO Online reported that organizations running self-hosted BeyondTrust Remote Support appliances should treat exposed systems as potentially compromised. BeyondTrust Remote Support was formerly known as Bomgar, according to The Hacker News. [4][6]