--- title: BeyondTrust zero-day tied to Chinese spies puts Remote... description: A suspected Chinese espionage group tracked as ARMORY CASTLE (formerly UNC5221, also known as WARP PANDA by CrowdStrike) exploited a critical zero-day,... canonical: https://daily.dev/posts/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert-meyvsy1y1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert | daily.dev og:description: A suspected Chinese espionage group tracked as ARMORY CASTLE (formerly UNC5221, also known as WARP PANDA by CrowdStrike) exploited a critical zero-day,... og:url: https://daily.dev/posts/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert-meyvsy1y1 og:image: https://api.daily.dev/og/posts/MEYvsY1Y1.png og:image:alt: BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary A suspected Chinese espionage group tracked as ARMORY CASTLE (formerly UNC5221, also known as WARP PANDA by CrowdStrike) exploited a critical zero-day, CVE-2026-102764, in BeyondTrust Remote Support appliances to gain root access, raid credential vaults, and establish persistent footholds. Mandiant and Google Threat Intelligence Group say exploitation began Aug. 29 and went undetected for a month because automated triage closed real alerts as false positives. Attackers deployed a PHP web shell (SAWFLY), escalated to root via a SUID binary, planted a persistent sudo backdoor, deployed a custom SOCKS5 tunneler (BARECLAW), and wiped over a dozen logs. BeyondTrust patched self-hosted appliances Oct. 8 and SaaS instances Oct. 9; organizations are urged to treat internet-exposed vulnerable appliances as compromised, snapshot before rebooting, rebuild from clean images, and rotate credentials only after patching. This is BeyondTrust's third critical Remote Support advisory this year, following CVE-2026-1731 which CISA added to its Known Exploited Vulnerabilities catalog. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-102764 and how severe is it? CVE-2026-102764 is a critical zero-day vulnerability in BeyondTrust Remote Support, scoring 9.3 on CVSS 4.0 and affecting versions up to 26.2.3. It allows an unauthenticated attacker to perform file operations leading to host-level root control and access to every credential the appliance stores or brokers. BeyondTrust disclosed it in advisory BT26-05 and released a patch on October 8. _Teams patching privileged access tools can track critical CVEs like this one on daily.dev._ ### Who is behind the BeyondTrust zero-day attacks and what is their history? The attacks are attributed to ARMORY CASTLE, a suspected PRC-nexus espionage group formerly tracked as UNC5221 and known as WARP PANDA by CrowdStrike. Active since at least October 2023, the group previously moved to mass exploitation of Ivanti Connect Secure flaws in 2024 and turned an Ivanti patch into a working exploit in 2025, a pattern Google Threat Intelligence Group expects to repeat with this BeyondTrust flaw. _Security teams tracking repeat edge-device attackers follow actor profiles like this on daily.dev._ ### What techniques did the attacker use to maintain persistence on compromised BeyondTrust appliances? After deploying a PHP web shell called SAWFLY, the attacker copied /bin/sh to /usr/bin/dbus-authd, made it root-owned with the SUID bit set, and planted a startup script writing a passwordless sudo entry into BeyondTrust's sudoers template so access survives reboots and config resets. They also deployed a custom SOCKS5 tunneler called BARECLAW routed through a hidden HAProxy listener and deleted over a dozen logs. _Responders rebuilding compromised appliances reference technique breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [BeyondTrust warns of critical flaws in remote access software](https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals) · BleepingComputer · 0 upvotes · 0 comments - [Unpatchable? How Chinese Hackers Hid in Dell VMs for 2 Years Using "Magic Packets"](https://daily.dev/posts/unpatchable-how-chinese-hackers-hid-in-dell-vms-for-2-years-using-magic-packets--fzvlv90ci) · InfoSec Write-ups · 29 upvotes · 0 comments - [Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk](https://daily.dev/posts/surge-in-bomgar-rmm-exploitation-demonstrates-supply-chain-risk-886kxvjrk) · Dark Reading · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert-meyvsy1y1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert","url":"https://daily.dev/posts/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert-meyvsy1y1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert-meyvsy1y1"},"datePublished":"2026-10-16T10:28:21.855Z","dateModified":"2026-10-16T11:09:17.059Z","description":"A suspected Chinese espionage group tracked as ARMORY CASTLE (formerly UNC5221, also known as WARP PANDA by CrowdStrike) exploited a critical zero-day,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7fa640982f0ac0c6bc9f8430703d76c8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7fa640982f0ac0c6bc9f8430703d76c8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert-meyvsy1y1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert-meyvsy1y1#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-102764 and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-102764 is a critical zero-day vulnerability in BeyondTrust Remote Support, scoring 9.3 on CVSS 4.0 and affecting versions up to 26.2.3. It allows an unauthenticated attacker to perform file operations leading to host-level root control and access to every credential the appliance stores or brokers. BeyondTrust disclosed it in advisory BT26-05 and released a patch on October 8. Teams patching privileged access tools can track critical CVEs like this one on daily.dev."}},{"@type":"Question","name":"Who is behind the BeyondTrust zero-day attacks and what is their history?","acceptedAnswer":{"@type":"Answer","text":"The attacks are attributed to ARMORY CASTLE, a suspected PRC-nexus espionage group formerly tracked as UNC5221 and known as WARP PANDA by CrowdStrike. Active since at least October 2023, the group previously moved to mass exploitation of Ivanti Connect Secure flaws in 2024 and turned an Ivanti patch into a working exploit in 2025, a pattern Google Threat Intelligence Group expects to repeat with this BeyondTrust flaw. Security teams tracking repeat edge-device attackers follow actor profiles like this on daily.dev."}},{"@type":"Question","name":"What techniques did the attacker use to maintain persistence on compromised BeyondTrust appliances?","acceptedAnswer":{"@type":"Answer","text":"After deploying a PHP web shell called SAWFLY, the attacker copied /bin/sh to /usr/bin/dbus-authd, made it root-owned with the SUID bit set, and planted a startup script writing a passwordless sudo entry into BeyondTrust's sudoers template so access survives reboots and config resets. They also deployed a custom SOCKS5 tunneler called BARECLAW routed through a hidden HAProxy listener and deleted over a dozen logs. Responders rebuilding compromised appliances reference technique breakdowns like this on daily.dev."}}]} ```