By The Epoch Times | Created at 2026-10-16 10:21:35 | Updated at 2026-10-16 11:13:19
1 hour ago
Google warned on Oct. 15 that organizations should prepare for potential widespread exploitation after a new bug was found in U.S. cybersecurity firm BeyondTrust’s remote support appliances.
The flaw affects BeyondTrust Remote Support, an enterprise tool that allows information technology teams to remotely access and troubleshoot computers and other devices. Successful exploitation of the vulnerability gives attackers access to credentials, lets them upload files at will, and lets them take control of the host, according to Google Threat Intelligence Group and Mandiant, Google’s cybersecurity threat intelligence and incident response firm.
On Oct. 15, Georgia-based BeyondTrust disclosed the vulnerability, CVE-2026-102764, affecting BeyondTrust Remote Support appliances.
During an incident response engagement, Mandiant identified evidence that Armory Castle, a suspected Chinese state-sponsored nexus espionage threat actor, exploited this vulnerability in late August.
“Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public,” Google said. “We strongly recommend that affected organizations immediately apply the security patches provided by BeyondTrust to remediate the vulnerability.”
CVE-2026-102764 affects all supported remote support versions up to 26.2.3 and allows an unauthenticated remote attacker to perform file operations on the appliance, which can lead to host-level control and access to every credential the appliance stores or brokers.
A BeyondTrust Oct. 15 blog post said that Armory Castle’s past documented targets “include legal services, SaaS providers, business-process outsourcers, technology companies, and government.”
It said Armory Castle has “historically demonstrated a high degree of operational security awareness, professional practices, and tradecraft.”
Earlier BeyondTrust Compromise at Treasury
In December 2024, Chinese hackers remotely breached the U.S. Treasury Department and stole documents from its workstations, according to a letter the agency sent to lawmakers. The Treasury Department described the breach as a “major incident.”
Chinese state-sponsored hackers compromised third-party software service provider BeyondTrust, accessing certain unclassified documents, according to the letter by Aditi Hardikar, an assistant Treasury secretary.
The letter stated that the hackers gained “access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users.”
The department did not specify how many workstations had been compromised or what kind of documents the hackers may have obtained. However, in the letter, it said that the BeyondTrust service had been taken offline and “at this time there is no evidence indicating the threat actor has continued access to Treasury information.”
The department said it was working with the FBI and the Cybersecurity and Infrastructure Security Agency to investigate the scope of the hack.
The incident occurred as U.S. officials continue to assess the scope of the cybersecurity breach from China’s state-backed Salt Typhoon hacking group, which has carried out a wide-ranging espionage campaign since 2022.
