22OCT

BeyondTrust tool hit before its advisory

2 min read

16:31UTC

BeyondTrust says a 9.3-rated flaw in its Remote Support help-desk tool was exploited as a zero-day from 29 August. It fixed its hosted customers by 9 October and told self-hosted operators on 15 October.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

BeyondTrust's self-hosted customers learnt of an exploited zero-day six days after its cloud was patched.

BeyondTrust says CVE-2026-102764, an authentication bypass in BeyondTrust Remote Support, the tool IT help desks use to take over a user's computer, was exploited as a zero-day from 29 August against one hosted instance and one self-hosted appliance. It scores 9.3 on the 10-point severity scale. Google's Mandiant attributes the activity to ARMORY CASTLE, which it describes as a suspected China-linked espionage group⁠¹; BeyondTrust links it to the same actor.

BeyondTrust had patched its cloud customers by 9 October but published its advisory on 15 October, so self-hosted operators learnt of the flaw six days after the hosted fleet was fixed. The Canadian Centre for Cyber Security confirmed exploitation in alert AL26-025 on 16 October⁠², the day CISA listed the flaw with a 19 October deadline for US federal agencies.

A remote-support console reaches every machine its help desk serves, which is what makes it worth a zero-day. In August, N-able shipped a hotfix while attackers were pivoting through its Take Control remote-access product. In BeyondTrust's case the sequencing favoured the vendor's own hosted customers: whoever ran the appliance on their own network carried six extra days of exposure without knowing it.

Deep Analysis

In plain English

IT help desks use BeyondTrust Remote Support to take control of a worker's computer and fix it from afar. BeyondTrust says attackers found a way in without a password and used it from late August. Google's Mandiant links the attacks to a suspected Chinese spying group it calls ARMORY CASTLE. BeyondTrust fixed its cloud version first. Companies that run the software on their own servers must install the patch themselves.

Deep Analysis

Root Causes

Remote-support tools hold privileged sessions into customer endpoints by design, so an authentication bypass hands over that trust in one step. An attacker inside a help-desk tool can reach any machine the help desk supports.

Hosted and self-hosted fleets also diverge. A vendor can patch its cloud instances quietly, but must publish to reach on-premises customers, and publication starts the clock for every other attacker.

What could happen next?

Risk
Self-hosted BeyondTrust Remote Support appliances left unpatched after the 15 October advisory face attackers beyond ARMORY CASTLE.
Precedent
Fixing hosted customers before disclosure leaves self-hosted customers exposed to a flaw the vendor already knows is exploited, a sequencing other vendors may copy or be pressed to abandon.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Check Point's June disclosure also revealed a remote-access authentication bypass exploited for about a month before the hotfix, with CISA setting a three-day deadline the same day. Both cases put the break-in at the tool built to grant trusted remote access.

Counter-parallel: Citrix disclosed its NetScaler zero-days in September on the day CISA listed them, with no staged fix for hosted customers first. BeyondTrust's order, cloud first and public advisory later, protected its own fleet while self-hosted customers waited.

Consensus view: Google's Mandiant attributes the exploitation to ARMORY CASTLE, which it describes as a suspected China-linked espionage group, and BeyondTrust links the activity to the same actor with moderate to high confidence. Two known victims, one hosted and one self-hosted, fit targeted espionage rather than mass exploitation.

Counter-view: BeyondTrust says it has seen no adversary activity since August, while Mandiant warns of possible broader exploitation. The Canadian Centre for Cyber Security's alert AL26-025 confirms exploitation from open-source reporting but makes no attribution of its own.

Key tension: Whether self-hosted operators, told six days after the hosted fleet was fixed, faced a window in which the public advisory itself pointed other attackers at unpatched appliances.

Sources:Rapid7·Canadian Centre for Cyber Security·CISA

Mentions:Mandiant →Google →CISA →China →Citrix →Check Point →N-able →BeyondTrust →BeyondTrust Remote Support →UNC5221 →CCCS →

First Reported In

Update #15 · Fridge hack spoils food in seven countries

Rapid7· 22 Oct 2026

Read original →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.