BeyondTrust PAM appliance backdoor survived every reboot

A Chinese state-backed group, tracked as ARMORY CASTLE, spent seven weeks inside a BeyondTrust Remote Support appliance via CVE-2026-102764 (CVSS 9.3). The backdoor rebuilt itself from a poisoned boot script on every reboot, and attackers used bt-secrets to drain the credential vault and delete logs.

• CVE-2026-102764 is an authentication bypass rated CVSS 9.3
• Backdoor re-added its root sudoers entry on every boot
• bt-secrets was used to extract the vault; logs were deleted
• Mandiant advises rebuilding the appliance from a clean image