Chinese Espionage Group Exploiting Critical BeyondTrust Remote Support Vulnerability

A suspected Chinese state-aligned threat group tracked as Armory Castle — also known as UNC5221 — has been observed actively exploiting a critical authentication bypass vulnerability in BeyondTrust Remote Support, according to Infosecurity Magazine reporting on Google threat intelligence. The vulnerability, CVE-2026-102764, affects versions 26.2.3 and earlier of BeyondTrust Remote Support, formerly known as Bomgar. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalogue and is urging organisations to patch without delay. Researchers note that Armory Castle's first known attack using this flaw occurred approximately seven weeks before the vulnerability was publicly disclosed, indicating the group had prior knowledge of the issue. The same threat group has previously targeted customers of Ivanti and Citrix products.

Why this matters for UK organisations

BeyondTrust Remote Support is used by IT and security teams across many UK organisations to provide privileged remote access for support and administration purposes. An authentication bypass in a tool of this nature is a serious concern: it sits at the heart of privileged access management, and a successful exploit can allow an attacker to gain initial access, establish persistence, escalate privileges and move laterally through an environment — all without triggering standard authentication controls. The broader pattern here is also worth noting. Armory Castle and similar groups have consistently targeted edge devices and remote access tools — Ivanti, Citrix and now BeyondTrust — as a deliberate strategy to compromise the tools that organisations use to manage and protect their networks. This is not an isolated incident but part of a sustained and methodical approach to gaining long-term access to high-value environments.

What to review

Organisations running BeyondTrust Remote Support should check their current version immediately. Patches are available for versions 24.3.1 and later; organisations on older versions must upgrade before they can apply the patch. Alongside patching, it is worth reviewing recent privileged access session logs for any activity that does not follow expected authentication patterns, particularly sessions initiated outside of normal working hours or from unexpected locations. More broadly, this is a useful prompt to audit which remote access and privileged access tools in your environment are exposed to the internet, whether access is restricted by IP allowlisting or other controls, and whether multi-factor authentication is enforced consistently across all privileged access pathways.

Source: Infosecurity Magazine