Canada's Cyber Centre issued an alert on October 16 about CVE-2026-102764, a critical BeyondTrust Remote Support vulnerability exploited in espionage attacks. Mandiant traced zero-day exploitation to late August and attributed it to ARMORY CASTLE, a suspected China-linked group. The flaw threatens appliances used by IT teams to access and troubleshoot internal endpoints.

BeyondTrust disclosed the vulnerability on October 15. Its incident timeline identifies August 29 attacks against one vendor-hosted Remote Support instance and one self-hosted appliance. Mandiant previously tracked ARMORY CASTLE as UNC5221. BeyondTrust describes the group's objective as long-term intelligence collection, with past targets including technology companies, governments and legal services.

The vendor rates CVE-2026-102764 critical, with a CVSS v4 score of 9.3. Internal messaging components fail to adequately validate message origins, allowing unauthorized file operations. Canada's Cyber Centre says exploitation requires neither authentication nor user interaction and can enable arbitrary file uploads that potentially lead to full appliance compromise.

Mandiant observed the attackers deploy the SAWFLY webshell and BARECLAW tunneler, obtain root-level control and delete logs to impede detection. They also used compromised administrator credentials to expand remote-session permissions and access internal endpoints. The researchers observed sensitive internal documents being transferred through the appliance's legitimate support tools for network reconnaissance.

BeyondTrust's advisory lists Remote Support versions 26.2.3 and earlier as affected. All Remote Support SaaS customers had received the fix by October 9. Self-hosted deployments running versions 24.3.1 through 26.2.3 need the BT26-05-RS patch; administrators should confirm automatic installation or apply it manually. Older installations must first upgrade to a supported version before applying the patch.

Canada's Cyber Centre recommends checking exposed appliances for unauthorized file activity. Mandiant advises treating internet-reachable appliances that were vulnerable during the exploitation window as potentially compromised until reviewed. Its guidance includes examining support-session activity and configuration changes, preserving evidence where compromise is suspected, and rotating credentials after patching or rebuilding the appliance.