TOPIC
Real-world exploitation of BeyondTrust Remote Support CVE-2026-102764 as a privileged remote-access identity/control-plane compromise path: host compromise, credential-vault access attempts, administrative/Jump Item authorization abuse and downstream remote sessions; preserve victim-scale, PRA-exploitation, credential-success and attribution boundaries.
1
5
3
3
3
NEW — zero-day exploitation verified by affected vendor and primary IR; credential-vault/admin/Jump Item/downstream remote-access abuse establishes identity-broker impact. Public evidence does not establish widespread post-disclosure exploitation, universal credential theft, PRA exploitation or independently multi-source actor attribution.
IDENTITY_INTRUSION_RESEARCH_TOPIC
—
—
—
Compromise of an internet-facing privileged remote-support appliance can become a downstream identity-broker compromise because the appliance stores or brokers credentials and remote-access authorization to internal endpoints.
Independent multi-victim telemetry quantifying credential extraction, remote-session abuse and downstream identity compromise.
For known or unruled-out host-level BeyondTrust compromise, patching alone is insufficient incident closure; rebuild or validated clean recovery plus dependency-ordered credential/session/component rotation is required to remove persistence and identity exposure.
Independent response-outcome telemetry across additional compromised appliances and downstream environments.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 5 Evidence
CVE-2026-102764 (CVSS v4 9.3) affects Remote Support <=26.2.3; insufficient message-origin validation can permit remote file operations. SaaS Remote Support was patched by Oct 9; self-hosted deployments require BT26-05-RS remediation.
لا يثبت: Every vulnerable instance was exploited, widespread campaign scale, or confirmed PRA exploitation.
فتح Run المصدرBeyondTrust reports exploitation of one hosted and one self-hosted Remote Support appliance on Aug 29; Mandiant independently confirmed the self-hosted incident. As of Oct 16, BeyondTrust knew only those two impacted customers and had not observed adversary activity since August; PRA shared code but no exploitation path was identified in internal testing.
لا يثبت: Widespread post-disclosure exploitation, confirmed PRA exploitation, or fully independent actor attribution.
فتح Run المصدرMandiant observed ARMORY CASTLE exploit CVE-2026-102764 as a zero-day, deploy SAWFLY and BARECLAW, delete logs, establish host persistence, attempt credential-vault extraction with bt-secrets, elevate administrative/Jump Item permissions, launch downstream remote-support sessions and use native file transfer for internal reconnaissance/data collection.
لا يثبت: Successful theft of every stored credential, universal downstream compromise, or a victim denominator.
فتح Run المصدرCanada's Cyber Centre classifies CVE-2026-102764 as Authentication Bypass by Spoofing (CWE-290), notes in-the-wild exploitation and that CISA added it to KEV on Oct 16, and urges remediation of affected Remote Support deployments.
لا يثبت: Victim denominator, actor identity, or downstream credential-compromise breadth.
فتح Run المصدرNHS England issued an active-exploitation alert for CVE-2026-102764 and assessed further exploitation as highly likely, urging immediate remediation of affected BeyondTrust Remote Support deployments.
لا يثبت: Observed post-disclosure victim count or successful compromise beyond known incidents.
فتح Run المصدرCross-layer correlation of appliance file-operation/webshell signals, vault-access commands, admin-role changes, Jump Item sessions, file transfers and downstream endpoint telemetry is stronger than isolated perimeter IOCs for detecting this intrusion class.
Measured SOC/IR performance, false-positive baselines and independent appliance telemetry.
No authoritative public denominator establishes widespread exploitation after disclosure; BeyondTrust last named two impacted customers and no observed activity since August.
Independent IR/CERT/provider victim telemetry or updated authoritative denominator.
Exact credentials successfully extracted, downstream identities/endpoints accessed and data-loss denominator remain incompletely public.
Victim vault audit, rotation scope, downstream session/file-transfer evidence and IR outcomes.
ARMORY CASTLE/UNC5221/WARP PANDA attribution is source-qualified but independent public forensic attribution beyond coordinated incident evidence is limited.
Separate authoritative/provider attribution with actor-linked infrastructure/malware/operational artifacts.
ATTRIBUTION_INDEPENDENCE