bleeping-computer Oct 16, 2026 · Crawled Oct 18, 2026

BeyondTrust patches zero-day exploited in attacks since August

3 Actors

AI Summary

BeyondTrust has patched a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support (RS) and Privileged Remote Access (PRA) appliances that was exploited in attacks since August 2026. The flaw is an authentication bypass allowing unprivileged remote attackers to perform file operations on unpatched systems. The China-nexus espionage actor 'Armory Castle' (also known as UNC5221 or 'Warp Panda') exploited the vulnerability to gain initial access, escalate to root privileges, deploy Sawfly web shell and Bareclaw tunneler malware, and move laterally using stolen credentials. Organizations with internet-exposed appliances during the exploitation window should assume compromise.

AI-extracted · verify before operational use

Extracted Entities 3 found

Threat Actor UTA0178 → Threat Actor WARP PANDA → Threat Actor HAFNIUM →

MITRE ATT&CK TTPs 9 techniques

T1003.001 LSASS Memory · Credential Access T1021.001 Remote Desktop Protocol · Lateral Movement T1055.001 Dynamic-link Library Injection · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1087.002 Domain Account · Discovery T1210 Exploitation of Remote Services · Lateral Movement T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access