Chinese-Linked Hackers Exploited Unseen Flaw in Remote-Access Software for Weeks, Google Says

Google's threat-intelligence researchers disclosed this week that a suspected Chinese state-linked hacking group spent nearly two months quietly exploiting a previously unknown flaw in widely used remote-support software before the vendor caught it. The vulnerability, in BeyondTrust's Remote Support appliances, let an unauthenticated attacker seize root control of systems that IT help desks and managed service providers use to reach into client networks, and the United States' top cyber-defense agency has now ordered federal civilian agencies to patch it within days.

The disclosure, made jointly on October 15 by Google's Threat Intelligence Group and its Mandiant incident-response unit alongside BeyondTrust's own advisory, describes an espionage campaign that began as a narrow, surgical operation and is now expected to widen now that the technical details of the flaw are public.

The numbers

The flaw is tracked as CVE-2026-102764, an authentication-bypass vulnerability carrying a severity score of 9.3 out of 10, according to BeyondTrust's own rating and confirmed by Canada's national cyber authority. It stems from weak validation of the origin of internal messages inside Remote Support appliances, which let an attacker upload files to the device without ever logging in. Every supported version of the product up to 26.2.3 is affected.

Mandiant traced the first confirmed exploitation to August 29, when the attackers hit one appliance hosted by BeyondTrust itself and one appliance run by a self-hosting customer. The intrusion went unnoticed for almost a month, until BeyondTrust's security team, hunting for the cause of an unrelated breach at another vendor that became public on September 27, found the same attack pattern on its own infrastructure the next day. BeyondTrust pushed a fix to its cloud-hosted customers by October 9 and disclosed the bug publicly on October 15, alongside patch BT26-05 for appliances customers manage themselves.

The U.S. Cybersecurity and Infrastructure Security Agency moved fast once the advisory went out. Its catalog of known exploited vulnerabilities shows the entry was added on October 16 with a compliance deadline of October 19 — a three-day window, reflecting the agency's judgment that the bug is both severe and already under active attack. Canada's cyber authority issued its own critical-severity alert the same day, telling government and private-sector operators to inventory every Remote Support deployment and confirm which ones are self-hosted and still unpatched.

How we got here

BeyondTrust's Remote Support product, formerly sold under the Bomgar name, is the kind of software that rarely makes headlines on its own: a tool help-desk staff and contractors use to take over a screen, move files, and troubleshoot machines remotely. That obscurity is precisely what makes it valuable to espionage operators, who have increasingly abandoned conventional phishing in favor of quietly compromising the edge appliances — VPN gateways, firewalls, and remote-access boxes — that sit at the perimeter of corporate and government networks.

Mandiant attributes the intrusion to a group it now calls ARMORY CASTLE, previously tracked as UNC5221 and also referred to in industry reporting as Warp Panda, which researchers assess with a suspected nexus to the People's Republic of China. The group has been active since at least October 2023 and has a documented history of burning zero-day vulnerabilities in other edge devices, including Citrix NetScaler and Ivanti Connect Secure appliances, before pivoting to broader, opportunistic exploitation once a flaw becomes publicly known. The Hacker News, which first aggregated the technical findings, noted that BeyondTrust itself described the group's approach bluntly in its own advisory: the actor used the zero-day "selectively against chosen targets," a pattern consistent with intelligence-gathering rather than disruption or financial gain.

Once inside an appliance, Mandiant's analysis shows, the attackers planted a custom PHP web shell they call SAWFLY, escalated to root privileges by hijacking a system binary, dumped credentials from BeyondTrust's internal secrets vault, and then quietly rewrote configuration files to funnel a hidden network tunnel through the appliance's own proxy — all while deleting the log files that would have recorded their movements.

Who is affected

BeyondTrust's own cloud-hosted Remote Support and Privileged Remote Access customers no longer need to act; the company applied the patch across its SaaS fleet on October 9. The exposure now sits almost entirely with organizations that run Remote Support on their own infrastructure — a common setup among banks, hospitals, government agencies, and managed service providers that use the software to support outsourced IT contracts and cannot or will not put a remote-access gateway in someone else's cloud.

For those customers, versions 24.3.1 through 26.2.3 require the BT26-05-RS patch applied manually from the appliance's administrative interface; anything older must first be upgraded to a supported release before the patch will apply. U.S. federal civilian executive-branch agencies fall under a binding CISA directive, but the practical urgency extends to any organization whose appliance was reachable from the open internet during the roughly six-week window between the first known intrusion and the October patch, since Google's researchers say any such device should be treated as potentially compromised until it has been forensically reviewed.

Reaction

Google's researchers were explicit that disclosure itself now raises the risk for laggards. In their joint write-up, the Threat Intelligence Group and Mandiant wrote:

"Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public."

Security outlets covering the disclosure echoed that warning. CSO Online reported that Mandiant specifically pointed to the aftermath of two Ivanti vulnerabilities disclosed in 2024, after which the same actor and copycat groups mounted mass scanning and exploitation campaigns within days of the technical details becoming public. BeyondTrust, for its part, said in its advisory that its own detection systems had caught signs of the intrusion during the escalation stage, though the alerts were not escalated for investigation until the pattern reappeared at another company.

What happens next

The immediate deadline is CISA's October 19 patch date for covered federal systems, but the broader test will be how quickly thousands of self-hosted Remote Support customers outside government move. Google's researchers have urged every organization that ran a vulnerable, internet-facing appliance during the exploitation window to assume compromise, rebuild affected appliances from a clean image rather than simply patching in place, and rotate every credential the appliance had access to only after that rebuild is complete.

Mandiant's own history with this threat actor suggests the next phase will be broader and less targeted: once a zero-day used sparingly by a sophisticated espionage group becomes a known, patchable bug, less disciplined criminal and state-aligned actors typically begin scanning the internet for appliances that administrators have not yet gotten around to updating. BeyondTrust has not disclosed how many customers worldwide run self-hosted Remote Support, and neither the company nor CISA has released a count of confirmed victims beyond the one BeyondTrust-hosted and one self-hosted instance Mandiant identified during its initial investigation. Further disclosures, from BeyondTrust, from CISA, or from the victims themselves, are likely in the coming weeks as incident-response firms work through appliances that were exposed during the six-week window before the patch existed.