Hospital IT teams know the device class well, and one of its flaws has been under active exploitation as a zero-day since late August. The target is a critical authentication bypass in BeyondTrust Remote Support appliances, abused by a suspected China-nexus espionage crew. Remote support platforms are the standard tool hospital service desks use to reach clinician workstations, imaging consoles, and lab systems.
Known as CVE-2026-102764, the bug gives an unprivileged remote attacker the ability to run file operations against appliances that lack the fix, and every Remote Support release through 26.2.3 is in scope. Cloud-hosted Remote Support and Privileged Remote Access customers received their patch on October 8; installations that are self-hosted require manual work when automatic updates are disabled. Because the two products share affected code, the vendor advised self-hosted PRA customers to apply the fix without delay as a precaution.
Attribution from Mandiant and Google Threat Intelligence Group points to a group tracked as Armory Castle, formerly UNC5221; CrowdStrike refers to the same actor as Warp Panda. The intruders escalated to root after gaining initial access by enabling Set User ID permissions. Log erasure followed, along with lateral movement enabled by stolen administrator credentials. Two pieces of tooling got planted during this phase: the Sawfly web shell and the Bareclaw tunneler.
Healthcare exposure is not hypothetical. Nation-state crews have repeatedly used remote-access appliances as a beachhead into provider networks that hold PHI. Security teams should inventory every on-premises Remote Support and PRA instance, confirm it is patched, check logs for SUID changes and unexpected administrator logins dating to August, and hunt for the Sawfly and Bareclaw indicators. Appliances that cannot be patched quickly should be pulled off the public internet and placed behind a VPN with MFA.
