What Happened
The Hacker News reports a China-nexus group named Armory Castle exploited a BeyondTrust Remote Support zero-day starting in late August. The flaw, CVE-2026-102764, scores 9.3 on CVSS. It is an origin-validation error in an internal messaging component, and a remote attacker performs file operations on the appliance.
Mandiant research shows the group gained root, copied a shell to a disguised SUID file, and edited configuration templates for passwordless root. It then used stolen admin credentials to open sessions to downstream systems. The attackers deleted logs and tunneled traffic through a custom SOCKS5 proxy. BeyondTrust patched SaaS customers on October 9. Self-hosted versions 24.3.1 through 26.2.3 need the BT26-05-RS patch applied by hand.
Why This Matters for Canadian Organizations
The report names no Canadian victims. The target profile still fits Canada. Armory Castle goes after legal services, SaaS providers, outsourcers, technology firms, and governments. Canadian law firms, managed service providers, and public bodies run remote support tools with deep reach into internal systems.
A remote support appliance holds credentials and session paths to many endpoints. One breach hands an attacker a map and a key ring. Financial institutions under OSFI Guideline B-13 and any organization holding personal data under PIPEDA face breach reporting duties if the appliance was exposed.
What to Do
Apply BT26-05-RS to every self-hosted appliance. Upgrade anything older than 24.3.1 first. Treat any internet-reachable appliance on a vulnerable version as compromised until reviewed. Hunt for /usr/bin/dbus-authd with the SUID bit, edits to /ns/config/haproxy.conf, and the SAWFLY web shell. Rotate stored secrets and review Jump Item sessions for unfamiliar activity. Read more in our TechTalk coverage.
