BeyondTrust’s sensors detected an intruder gaining privileges on a Remote Support appliance. The alerts existed, but an automated triage tool in a third-party detection platform closed them as false positives. A separate threat hunt eventually found the compromise, according to the company’s incident account updated on October 16. The case shows why an apparently quiet alert queue cannot settle whether a remote-access system is safe. [1]
Organizations running self-hosted Remote Support should confirm installation of the BT26-05-RS patch and investigate earlier exposure. BeyondTrust says its hosted Remote Support customers were patched by October 9; that closes the entry point, while credentials and settings still need review when an intrusion is suspected. [2] [3]
The sensors fired; a different hunt found the attacker
The vendor dates the two known compromises to August 29, 2026: one BeyondTrust-hosted instance and one customer-hosted appliance. It says its sensors raised alerts during privilege escalation, but the detection platform’s built-in triage layer dismissed them. The account identifies automated triage; it does not establish that a language model made those decisions. [1]
The discovery came through another route. Public reporting about an attack against a different security-device provider prompted BeyondTrust to hunt for related behavior. On September 28, that hunt surfaced the hosted intrusion. BeyondTrust says it contained the affected instance within 27 minutes of detection, reproduced the entry mechanism that evening, and received corroborating findings from Mandiant’s separate customer investigation on September 30.
Those are two different clocks: a fast response after the hunt found the attacker, and almost a month between the dated intrusion and discovery. Closing an alert had removed it from immediate attention without undoing the underlying activity. BeyondTrust says it is working to prevent automated triage from independently closing high-severity signals and to recheck external verdicts.
From a file operation to a route into the network
The entry point was CVE-2026-102764. An internal messaging component did not adequately validate the origin of incoming messages, allowing an unauthenticated attacker to perform file operations on the appliance. BeyondTrust has withheld exploitation details while customers patch. This was an appliance intrusion, rather than a support scam that persuaded someone to install a remote-control client. [2]
In Mandiant’s investigation, suspicious web requests preceded creation of the SAWFLY web shell by about 11 minutes. A web shell lets an operator send instructions through the compromised server’s web interface. The attacker then obtained root-level control, established persistence, and tried several variations of a native administrative utility to retrieve the credential vault. The recovered attempts do not, by themselves, establish that every stored secret was successfully extracted. [3]
The appliance’s trusted role made that access valuable. Mandiant observed changes to remote-access permissions, use of support file transfers to obtain internal IT documents, and deployment of the BARECLAW tunneler. A modification to the appliance’s reverse-proxy configuration routed a special web path to the tunneler. The attacker was turning an existing entrance for legitimate support into a channel for its own traffic.
The operator also deleted local logs and artifacts. That changes the evidential value of a clean-looking appliance: the same administrative access that permits persistence can remove the local record responders would normally consult. External syslog, proxy, firewall, and session records become particularly important.
Patching the entrance does not settle the credential question
The vendor advisory covers Remote Support 26.2.3 and earlier unless patched. BT26-05-RS is available for versions 24.3.1 through 26.2.3; older self-hosted installations need an upgrade to a supported version before applying it. Check the /appliance interface rather than assuming automatic updates succeeded. BeyondTrust also recommends patching self-hosted Privileged Remote Access because it shares the affected code, while saying it has not identified a way to exploit this flaw in PRA. [2]
For a suspected compromise, preserve evidence before changes or a reboot and coordinate with BeyondTrust Support. Mandiant recommends isolating suspect appliances at the perimeter and rebuilding from a clean, patched image when compromise is confirmed or cannot be ruled out. That can interrupt support operations, so the response needs coordination with the people who rely on them. [3]
Review administrator and API accounts, Jump Item permissions, session policies, integrations, and destinations for forwarded logs. Rotate affected stored or brokered credentials after patching or rebuilding; changing them while an attacker still controls the appliance can expose the replacements. Examine downstream support sessions and file transfers, not just the appliance’s current patch status.
This differs from the BeyondTrust vulnerabilities reported in 2024. The current investigation concerns a separate 2026 flaw and intrusion. It also shares a recovery problem with the recent ConnectWise/SkyKick application-credential incident: shutting an original access path does not automatically revoke every permission or secret an attacker reached through it.
The lasting lesson is concrete: retain and revisit dismissed high-severity alerts, keep evidence outside the device being defended, and treat patch verification and intrusion recovery as separate decisions.
References
- BeyondTrust Security Team. “ARMORY CASTLE and BT26-05: What Security Teams Need to Know.” Updated October 16, 2026, 12:00 p.m. EDT. Incident account.
- BeyondTrust. “BT26-05: Improper Origin Validation in an Internal Messaging Component.” October 15, 2026; accessed October 19, 2026. Security advisory.
- Frost, J., et al. “ARMORY CASTLE Exploits BeyondTrust.” Mandiant and Google Threat Intelligence Group, October 15, 2026. Investigation and response guidance.
