Mandiant found attackers exploiting CVE-2026-102764 in BeyondTrust Remote Support appliances before a patch existed. Its October 15 investigation describes persistent administrative access, attempts to harvest stored credentials and access to downstream endpoints.

Remote Support lets help desks connect to other machines. Compromising that appliance can expose both its stored secrets and the systems it is authorized to reach.

Which installations need the fix

The BT26-05 advisory lists all Remote Support versions through 26.2.3 as affected. Improper validation of internal messages lets an unauthenticated remote attacker perform file operations on the appliance.

  • Self-hosted 24.3.1 through 26.2.3: apply BT26-05-RS, or verify that automatic updates applied it. A version number in that range alone does not establish patch status.
  • Older than 24.3.1: upgrade to a version that can receive the patch, then apply it.
  • SaaS: the advisory says all Remote Support tenants were patched by October 9. Customers still need to consider prior credential and configuration exposure where applicable.

BeyondTrust’s incident account also recommends its precautionary patch for self-hosted Privileged Remote Access. That product shares affected code, but the company says its testing has found no exploitable path there. Do not equate that precaution with confirmed exploitation of both products.

Observed intrusions, with a bounded victim count

Exploitation status: observed in Mandiant’s incident response and reported by the affected vendor, with a CISA exploited-vulnerability listing.

BeyondTrust dates the attacks to August 29 and says it knew of two affected customers as of its October 16 update. One used a hosted instance and one a self-hosted appliance. This is the vendor’s reported visibility, not a global compromise count.

Mandiant associates the intrusion with ARMORY CASTLE, a suspected China-linked espionage group previously tracked as UNC5221. Its investigation found a web-accessible backdoor, a tunneling tool, persistent privilege changes and deletion of appliance logs.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, with forensic triage marked “Yes.” That is the catalog-addition date; disclosure was October 15 and the observed attacks predated both.

Mandiant warns that broad exploitation could follow disclosure. That forecast is distinct from evidence that broad exploitation has already occurred.

Patch, preserve evidence and review downstream access

Mandiant recommends patching promptly while coordinating containment with support operations. For an appliance showing compromise, preserve evidence before disruptive changes or reboot, and follow its isolation guidance with BeyondTrust Support.

  1. Check the patch separately from compromise status. Installing the fix closes the entry point; it does not remove persistence already installed.
  2. Keep evidence outside the appliance. Preserve forwarded system logs, reverse-proxy records and firewall logs across the exposure window. Attackers deleted local records in this investigation.
  3. Review account and session changes. Investigate unexplained administrator logins, remote-access permissions raised to Administrator, file transfers and gaps in log forwarding.
  4. Rebuild compromised or unresolved appliances using the published guidance. Mandiant warns that persistence can survive reboot and configuration reset. Coordinate recovery and restore only reviewed configuration.
  5. Rotate exposed credentials after securing the appliance. Include downstream credentials and integration secrets, and review endpoints reached during suspicious sessions. Replacing secrets on an attacker-controlled appliance can expose the replacements.

BeyondTrust makes the affected product; Mandiant sells incident-response and security services. Both participated in the investigation. BeyondTrust’s suggestion of AI-assisted exploit development is explicitly an assessment without forensic proof, and is unnecessary to establish the patching need.

Caveat: two known victims and a warning about future attacks establish neither a complete victim count nor the safety of an unreviewed patched appliance.