Canadian organizations that run BeyondTrust Remote Support on their own appliances need to act this week. A suspected state-backed group exploited a critical BeyondTrust zero-day, tracked as CVE-2026-102764, before a patch existed. Now that the flaw is public, wider attacks may follow.
Here is what happened, who is affected, and what Canadian IT teams should do next. I will stick to facts from the Canadian Centre for Cyber Security, BeyondTrust and Mandiant.
What the BeyondTrust Zero-Day Is
CVE-2026-102764 is an authentication bypass by spoofing flaw (CWE-290). According to the Cyber Centre alert AL26-025, it affects Remote Support versions 26.2.3 and earlier.
The problem sits in internal messaging components that fail to validate where a request comes from. As a result, a remote attacker with no credentials can perform file operations on the appliance. No user action is needed. In turn, arbitrary file uploads can lead to full compromise of the appliance.
That matters because Remote Support is a trusted tool. IT teams use it to reach and fix endpoints across the whole estate. Therefore, a hijacked appliance gives an attacker a map of who connects to what.
Timeline: From Zero-Day to Public Patch
The BeyondTrust security team published a clear timeline:
- August 29, 2026: the actor exploited the flaw against one BeyondTrust-hosted instance and one self-hosted appliance.
- September 28: BeyondTrust’s threat hunting found the activity, and the team contained it within 27 minutes.
- October 8: BeyondTrust released the BT26-05 patch for SaaS and self-hosted customers.
- October 15: the CVE, the advisory and Mandiant’s analysis went public together.
Next, the Cyber Centre issued its alert on October 16. On the same day, CISA added the CVE to its Known Exploited Vulnerabilities catalog. So far, BeyondTrust says it knows of only two impacted customers.
What the Attackers Did After Getting In
Mandiant’s analysis links the BeyondTrust zero-day attacks to ARMORY CASTLE, a suspected PRC-nexus espionage group formerly tracked as UNC5221. The details show a patient, skilled operator.
First, the actor planted a webshell that Mandiant calls SAWFLY. Then it copied the system shell and set root SUID permissions on the copy. That trick gave it a hidden root backdoor on the host.
After that, the actor tried to dump the appliance’s credential vault. It also added a startup script that granted passwordless root rights, so access would survive reboots. Later, it raised an account’s Jump Item and Team permissions from “No Access” to “Administrator.”
With those rights, the actor opened support sessions to internal endpoints. It then pulled out documents such as software inventories. Finally, it hid a tunnel called BARECLAW behind the appliance’s HAProxy service and deleted logs along the way.
What the Cyber Centre Recommends for Canadian Organizations
The Cyber Centre strongly recommends the fixed version for the BeyondTrust zero-day. Specifically, it asks organizations to:
- find every Remote Support deployment and note whether it is SaaS or self-hosted;
- check the installed version, since 26.2.3 or earlier is affected;
- upgrade anything older than 24.3.1 to a supported version first;
- apply the BT26-05-RS patch to self-hosted appliances on 24.3.1 through 26.2.3;
- confirm automatic updates where appropriate;
- review exposed appliances for unexpected file activity.
Good news for SaaS customers, though. BeyondTrust patched all Remote Support SaaS and Privileged Remote Access SaaS tenants as of October 9, 2026. Those customers need no extra action for the flaw itself.
What about self-hosted Privileged Remote Access? BeyondTrust says its testing found no way to exploit the flaw there. Even so, PRA shares the affected code. For that reason, the vendor released the patch for PRA too and urges customers to apply it.
If you find matching activity, report it through My Cyber Portal or email contact@cyber.gc.ca.
Hunting and Hardening Beyond the Patch
Patching closes the hole that the BeyondTrust zero-day opened. However, it does not undo an earlier break-in. Mandiant gives clear advice here. Treat any internet-facing appliance that ran a vulnerable version as possibly compromised until someone reviews it.
Start with your logs. This actor deletes local logs, so forward appliance syslog to your SIEM in near real time. Then hunt for behaviour rather than single indicators. BeyondTrust suggests these signals:
- admin sessions from home broadband or commercial VPN addresses that you cannot tie to a ticket;
- unknown script files in web directories;
- changes to Jump Item or Team permissions;
- gaps in log forwarding that start and end within one session.
Also, lock down the admin side. Mandiant advises limiting the /login and /appliance interfaces to trusted networks. It also recommends SAML single sign-on with phishing-resistant MFA.
If you find anything, treat every stored or brokered credential as exposed. Still, rotate them only after you patch or rebuild. Otherwise, an attacker who still controls the box can capture the new ones.
Why Remote Access Tools Keep Getting Hit
This is not a one-off pattern. BeyondTrust notes that the same actor has used zero-days against Citrix NetScaler and Ivanti Connect Secure. Our earlier post on NetScaler vulnerabilities for Canadian IT teams covered the same kind of edge risk.
Moreover, BeyondTrust shared an uncomfortable lesson. Its sensors fired when the actor escalated privileges. Yet an automated triage tool closed those alerts as false positives. In the end, a hunt driven by threat intelligence found the intruder.
So the takeaway for Canadian teams is twofold. Patch the BeyondTrust zero-day now, and then check whether your own tools can quietly close critical alerts. Mandiant warns that broad exploitation often follows disclosure. In short, the window to act is closing fast.
No comment