BeyondTrust Zero-Day CVE-2026-102764: Secure Remote Access

Why do attackers go after remote access appliances? Because compromising one gives them reach, credentials and stealth in a single step. This campaign shows all three.

• Reach. Per Mandiant's analysis, the attackers used compromised administrator credentials to launch remote sessions to downstream systems listed in the appliance's Jump Item inventory, then downloaded sensitive internal documents.
• Credentials. They used the appliance's own command-line utility to try to harvest stored passwords, API keys and endpoint credentials, and edited configuration templates to obtain passwordless root for a service account.
• Stealth. They routed traffic through commercial VPN exit nodes and compromised home and small-office routers, and deleted system, web server and application logs to hinder investigation.

The timeline is the uncomfortable part. Exploitation started on August 29, and the public advisory arrived on October 15, roughly six and a half weeks later. During that window, no signature or patch could have protected an exposed appliance. That is the defining feature of a zero-day, and it explains why Google's guidance is blunt: any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed.

This is also part of a pattern. The same quarter has brought exploited flaws in VPNs, firewalls, email gateways and backup consoles. Edge and management systems are now where attackers start, because they are exposed, privileged and often under-monitored.

How does the BeyondTrust attack chain work? Based on the published analysis, it unfolds in stages:

1. Initial access. The attacker exploits CVE-2026-102764 to perform file operations on the appliance and plant a lightweight PHP web shell called SAWFLY, which gives interactive access and encrypted command and control.
2. Privilege escalation. The attacker copies the system shell to a new file, sets root ownership and the SUID bit, and gains root.
3. Credential theft and lateral movement. Stored secrets are harvested and the attacker opens remote sessions to systems the appliance manages.
4. Persistence and tunneling. A custom SOCKS5 tunneler called BARECLAW is deployed, the HAProxy configuration is edited so it is reachable from the internet, and persistence survives reboots.
5. Cover-up. Logs are deleted.

What should you do now? Use this order:

1. Identify every instance. Inventory all BeyondTrust Remote Support deployments, self-hosted and SaaS, including ones set up by a business unit or a vendor.
2. Patch. Self-hosted versions from 24.3.1 through 26.2.3 should apply the BT26-05-RS patch. Versions older than 24.3.1 must upgrade to a newer release to be fixed. SaaS tenants were patched by October 9.
3. Assume breach if you were exposed. If a vulnerable appliance was internet-facing since late August, hunt before you trust it: look for unexpected PHP files, a new SUID binary named dbus-authd, changes to the HAProxy configuration, missing or truncated logs and unusual outbound connections.
4. Rotate secrets. Reset every credential, API key and service account stored in or reachable from the appliance.
5. Review session history. Audit remote sessions launched from the appliance to downstream hosts and check what data left.
6. Reduce exposure. Restrict access to the appliance by IP or place it behind a zero-trust gateway, and send its logs off-box so an attacker cannot erase them.

If this feels like a lot for a small team, a managed SOC with SIEM and MDR can run the hunt and keep immutable copies of the logs for you.

What do enterprises gain by treating remote access tools as crown jewels? More than a clean incident report.

• A smaller blast radius. If the appliance sits in a segmented management zone with tightly scoped credentials, a compromise does not automatically become a compromise of the whole network.
• Faster detection. Logs forwarded to a SIEM in real time survive the attacker's cleanup. The log deletion seen in this campaign matters far less when a copy already exists elsewhere.
• Shorter exposure windows. A defined process for emergency patching of internet-facing systems, with clear owners, turns a six-week blind spot into a matter of days once a fix exists.
• Lower audit and insurance friction. Documented inventories, access reviews and monitoring of privileged tools are exactly what auditors and cyber-insurance underwriters ask for.
• Less operational drag. Outsourcing routine patching, asset inventory and backup to IT managed services frees internal staff for projects instead of emergency weekends.

Network design plays a part too. Resilient, well-segmented connectivity, such as multi-operator SD-WAN and managed internet access, makes it easier to confine management traffic, apply consistent policy across sites and keep working while you isolate a suspect system.

HIT Communications has supported enterprises for more than 30 years across Latin America, the United States and Europe. We help clients protect the systems that attackers like best: internet-facing appliances, remote access tools and the identities behind them.

Our managed SOC, SIEM and MDR services monitor your environment around the clock, collect and preserve logs off the device, correlate threat intelligence with your asset inventory and run threat hunts when an advisory like BT26-05 lands. Our IT managed services handle patch orchestration, asset discovery, cloud infrastructure and backup, so an emergency patch is a routine task, not a scramble. And our multi-operator connectivity and SD-WAN solutions provide the segmentation and resilient paths that keep management traffic contained.

If you are not sure which remote access tools you have, who can reach them or whether they were exposed this autumn, we can start with a short exposure review and a prioritized action plan.

The BeyondTrust zero-day is a reminder that the tools built to help administrators are also the tools attackers most want to control. A critical flaw, six weeks of silent exploitation and a toolkit designed to steal secrets and erase evidence add up to a clear message: treat privileged remote access as tier-zero infrastructure.

Patch to BT26-05-RS if you run an affected self-hosted version, hunt for the indicators described above, rotate everything the appliance could reach, and move its logs off the box. Then put the longer-term controls in place: an accurate inventory, restricted access, segmentation and continuous monitoring.

If you want an expert view of your exposure, talk to the HIT Communications team and we will help you turn this advisory into a concrete plan.