Google warns suspected China-linked hackers could exploit BeyondTrust flaw
Google said attackers used the flaw to steal credentials and take host control, and Shadowserver found more than 1,400 exposed appliances.
- BeyondTrust patched CVE-2026-102764 on October 8, a critical authentication bypass vulnerability that the China-linked hacking group Armory Castle exploited since August to compromise Remote Support appliances.
- Successful exploitation allows unprivileged remote attackers to perform file operations and escalate to root-level control of the appliance host, granting access to every credential the appliance stored or brokered.
- Google warned on Thursday that organizations should prepare for "potential widespread exploitation" after the vulnerability's disclosure, urging swift action to patch or mitigate the flaw before attackers exploit it widely.
- Attackers deployed Sawfly web shell and Bareclaw tunneler malware to evade detection, according to Mandiant; BeyondTrust noted self-hosted Remote Support installations require manual patching if automatic updates are not enabled.
- CVE-2026-102764 continues a string of BeyondTrust flaws exploited by state-backed actors; Silk Typhoon previously compromised 17 Remote Support SaaS instances to access sensitive Treasury Department data.
10 Articles
10 Articles
Google warns suspected China-linked hackers could exploit BeyondTrust flaw
Google warned on Thursday that organizations should prepare for "potential widespread exploitation" after a new bug was found in US cybersecurity firm BeyondTrust's remote support appliances.
Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors
A suspected China-linked espionage group exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to gain access, reach root privileges and install tools for continued access. Google Threat Intelligence Group (GTIG) says the activity took place in late August 2026, before BeyondTrust disclosed the flaw on October 15. The vulnerability, tracked as CVE-2026-102764, could let […]
The report warns that the vulnerability has been publicly disclosed and that businesses should "prepare for potential large-scale exploitation." The photo shows the exterior of Google's headquarters in Mountain View, California, on July 31, 2025. (John Fredricks/The Epoch Times)
Coverage Details
Bias Distribution
- 50% of the sources are Center, 50% of the sources lean Right
Factuality
To view factuality data please Upgrade to Premium
