BeyondTrust Remote Support (versions 26.2.3 and below)
A platform IT teams use to remotely access, diagnose, and fix computers and devices — widely used by managed service providers and enterprise help desks.
Root Cause
The software failed to properly verify the origin of incoming messages, allowing a malicious party to send instructions the system would treat as legitimate without ever confirming they came from a trusted source.
Attack Vector
The China-linked group Armory Castle (also tracked as UNC5221) exploited this as a zero-day (a flaw attacked before a patch exists) from 29 August onward. Once inside, they deployed a webshell called Sawfly — a small program installed on a compromised server that lets attackers run commands remotely — gained root-level control, harvested credentials, deleted logs to cover their tracks, and used the platform's own file-transfer tools to extract sensitive internal documents.
Detection Notes
Look for unexpected administrator account permission changes, missing or truncated system and web server logs, and outbound connections to unfamiliar IP addresses from your BeyondTrust appliance.
Recommended Actions
- Apply patch BT26-05-RS immediately. SaaS customers were patched automatically on 9 October; self-hosted customers must apply it manually.
- If running versions older than 24.3.1, upgrade first, then apply the patch.
- Audit administrator account permissions and review logs for anomalous activity going back to late August.