Counting What Is Reachable: BeyondTrust Remote Support After the Armory Castle Intrusion
Google's threat intelligence group and Mandiant reported that a suspected China-nexus actor tracked as Armory Castle exploited CVE-2026-102764 in BeyondTrust Remote Support appliances from late August 2026. BeyondTrust's advisory BT26-05 scores the flaw 9.3 and describes an authentication bypass affecting Remote Support 26.2.3 and earlier. The vendor patched SaaS customers on 8 October 2026 and disclosed the vulnerability on 15 October 2026; self-hosted appliances need manual patching unless automatic updates are enabled.
For an organisation that runs one of these appliances, the first question is unglamorous: how many of them does the internet actually reach? Everything else follows from that number, including whether the exploitation window applies to you at all.
What the incident establishes
The published record is specific about mechanics and vague about scope. Mandiant's account says the actor used the flaw for initial access, escalated from the web service account to root by copying the system shell to a new path and enabling SUID permissions, and then worked from the appliance outward: a Sawfly PHP webshell for command and control, the appliance's own secrets utility to read stored credentials, and Jump Items raised to Administrator so that remote sessions to downstream systems could be launched at will.
Neither the vendor nor Google has published a count of compromised organisations, and the root cause of CVE-2026-102764 remains withheld. That leaves asset owners with a question they can answer themselves: which of my appliances was reachable, on a vulnerable version, during the relevant weeks.
What a title query can and cannot show
ZoomEye's fingerprints for this vendor are uneven, which is worth knowing before anyone quotes a headline number. The application fingerprints barely register, while branding in the page title finds far more. I ran a small set of queries on 2026-10-23 to see the gap.
| Query executed 2026-10-23 (UTC) | Matching assets |
| --- | ---: |
| title="BeyondTrust" | 966 |
| title="BeyondTrust" && is_domain=true | 584 |
| title="BeyondTrust" && port="443" | 269 |
| title="BeyondTrust" && port="80" | 203 |
| app="BeyondTrust Privileged Remote Access" | 226 |
| title="BeyondTrust Remote Support" | 3 |
| app="BeyondTrust" | 1 |
| app="BeyondTrust Remote Support" | 0 |
The 966 figure comes from a single Search query and is the widest of the set. A second reference point exists in public telemetry: Shadowserver tracks more than 1,400 exposed BeyondTrust instances across Remote Support and Privileged Remote Access. Both numbers describe reachability. Neither describes vulnerability.
The split between 966 and 584 is the useful detail. Roughly three in five matches are website or domain assets, which is consistent with login portals, documentation and reseller pages carrying the vendor name rather than with appliance hosts. The port breakdown behaves the way an appliance fleet should: 269 matches answering on 443 and 203 on 80 overlap with the total rather than adding to it.
Why the fingerprint gap matters for triage
Anyone who searched only on app="BeyondTrust Remote Support" would see zero results and would reasonably conclude that the product is not exposed anywhere. The same search on Privileged Remote Access returns 226. This is a fingerprint coverage problem, not an exposure problem, and it cuts both ways: a low count can understate your estate, and a branding query can overstate it with unrelated web pages.
The practical reading is that no single query settles the question. A title-based search is a starting inventory, honest about being approximate. Matching those results against your own known internet ranges, certificates and DNS records turns it into a list you can act on. Anything left over after that reconciliation is worth a manual look.
A short sequence for this week
- Sweep external ranges with a branding query such as
title="BeyondTrust", then filter the results by your own netblocks, certificate subjects and hostnames. - Compare the surviving hosts against your configuration management records and confirm which run 26.2.3 or earlier.
- Patch every one of them, and check whether automatic updates had silently been disabled.
- Restrict
/loginand/applianceat the network edge, block inbound traffic to the appliance's public address at the firewall rather than inside the appliance, and log the denials. - Treat any appliance that was reachable on a vulnerable version during the window as possibly compromised, which in practice means rebuilding it from a clean image rather than cleaning it in place. That last step is the one teams skip. Mandiant's own wording is blunt: an internet-reachable appliance on a vulnerable version during the exploitation window should be considered potentially compromised until someone reviews it. Review means memory and configuration inspection, not a patch and a shrug.
Limits of this measurement
The counts above are a snapshot taken on 2026-10-23, after the public disclosure, when some owners had already patched or pulled appliances offline. ZoomEye records what answers a scan, so patched but still reachable instances are counted, and appliances behind a VPN or an allowlist are not. Results also include honeypots and, at the margins, pages that merely mention the vendor. None of these numbers identify a vulnerable host, and none of them measure exploitation.
What the measurement does provide is a defensible starting list for an organisation that has lost track of its remote-support estate. For a class of appliance that has now been exploited three times in three years, that list is worth keeping current.
References
- BeyondTrust advisory BT26-05, CVE-2026-102764: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
- Google Threat Intelligence, Armory Castle exploits BeyondTrust: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
- BleepingComputer, BeyondTrust warns of critical Remote Support flaw exploited in attacks: https://www.bleepingcomputer.com/news/security/beyondtrust-warns-of-critical-remote-support-flaw-exploited-in-attacks/
- Infosecurity Magazine, China Espionage Actor Actively Targeting Critical BeyondTrust Flaw: https://www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/
- Shadowserver BeyondTrust exposure dashboard: https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=90&vendor=beyondtrust&model=privileged+remote+access&model=remote+support&dataset=count&limit=10000&group_by=geo&stacking=stacked
- ZoomEye search used above: https://www.zoomeye.ai/searchResult?q=dGl0bGU9IkJleW9uZFRydXN0Ig%3D%3D
