The box that holds the keys to every PC you support. That’s what the attackers went after.

On October 16, CISA warned about CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support, the product formerly known as Bomgar. It affects versions 26.2.3 and earlier. CISA says threat actors are using it to get in, then establishing persistence, escalating privileges and moving laterally.

The vendor’s advisory and follow-up post fill in the dates. A suspected China-nexus espionage actor first exploited the flaw on August 29, against one vendor-hosted instance and one self-hosted appliance. The patch shipped on October 8. Public disclosure came on October 15.

That’s 7 weeks between the first exploitation and the day the rest of us heard about it.

What the attackers did with the box

A remote support appliance is a broker. It stores privileged credentials, holds a list of systems it reaches and opens sessions onto them. The vendor puts it plainly: that makes it a credential source and a map of who connects to what.

According to the vendor’s post, the actor planted a web shell and worked through it by hand. It reached full administrative control of the appliance within minutes and set up persistence designed to survive a reboot. Then it read the appliance’s stored secrets and used administrative access inside the application to reach downstream systems.

Before leaving, it deleted logs and its own tooling.

If you run remote support for clients, sit with that for a second. The tool your team uses to fix things was used to reach the same machines, with credentials the tool already held.

Why the appliance won’t tell you what happened

The vendor’s own conclusion is the important one. Evidence kept only on the appliance might not survive, and what is there might have been changed. The vendor says it should not be trusted at face value.

So stop looking at the box for the answer. Look at everything around it.

There’s a second lesson in the vendor’s post, and it’s an honest one. Its sensors fired when the actor escalated privileges. An automated triage tool closed those alerts as false positives. The vendor found the intrusion a month later through threat hunting, and now recommends treating a triage verdict as one input, not the final word.

That’s not a criticism of anyone. It’s what happens when nobody reviews what the automation closed.

Where the evidence lives: network and identity

The vendor and CISA point to the same places to hunt. Almost all of them sit outside the appliance.

Sessions from places they shouldn’t come from. The vendor says the actor connected through commercial VPN exits and compromised home and small-office routers, so its traffic looked like consumer broadband. Hunt for privileged or administrative sessions from residential or commercial VPN addresses that you don’t tie to a known engineer or a ticket.

Permission and policy changes. Look for unauthorized account, permission or session-policy changes, particularly to Jump Items or Teams on the appliance.

Gaps in the logs. CISA lists unexpected gaps in logs or log forwarding as a sign of activity. The vendor narrows it down: gaps that start and end within a single session. You only see a gap if the logs were forwarded somewhere else first.

Brokered credentials used outside the tool. After rotating, the vendor says to watch for those accounts authenticating outside a managed session or from unfamiliar locations. CISA adds a review of new MFA registrations on privileged accounts.

Every one of those is a network or identity signal. None of them depends on an agent on the appliance.

What to do this week

1. Patch. Self-hosted appliances on 24.3.1 or later apply BT26-05-RS from the /appliance interface; older versions upgrade first. The vendor says SaaS instances were patched as of October 9.

2. Preserve, then forward. CISA says to snapshot or image the appliance, forward appliance syslog and session events to your SIEM now and collect web application firewall, reverse-proxy and perimeter firewall logs for the exposure window.

3. Hunt back to August 29 for the 4 signals above, using the logs held off the box.

4. Rotate every credential the appliance stored or injected, revoke all active support sessions and review new MFA registrations on privileged accounts, in line with CISA’s order of steps.

5. Lock it down. The vendor recommends exposing only what users need, restricting admin interfaces to trusted networks and allowing outbound traffic from the appliance only to the destinations it needs.

Step 1 takes minutes. Steps 2 and 4 take planning, because rotation touches every client system the appliance reaches. Step 3 is only as good as the logs you have off the box.

The outcome: caught by what surrounds the box

Do this and the appliance stops being a blind spot. The session from a residential address shows up in the network data. The permission change and the log gap show up in what you forwarded. The credential used outside a managed session shows up in identity logs. Wiping the box doesn’t wipe any of that.

My advice would be to forward appliance logs off the box today, whichever remote support tool your team runs. It’s the one step that makes every other step possible.

This is exactly what our Expert-led SOC watches: network and identity activity across the whole MSP estate, with people reviewing what the automation flags, so the signals that matter get detected and escalated to your team. It’s how you close the gap around the tools you don’t see inside.

Key takeaways

• A suspected China-nexus actor exploited CVE-2026-102764 in BeyondTrust Remote Support from August 29, 2026, about 7 weeks before public disclosure.

• The vendor says the actor read stored secrets, used admin access to reach downstream systems and deleted logs.

• Evidence kept only on the appliance should not be trusted at face value, so the proof sits on the network and identity side.

• Hunt for sessions from residential or VPN addresses, permission changes, log gaps and brokered credentials used outside managed sessions.

• Patch, preserve and forward logs, hunt back to August 29, then rotate credentials and revoke sessions.

About enhanced.io

enhanced.io is a channel-only Open XDR SOCaaS built exclusively for MSPs, with 400+ integrations across endpoint, network, cloud, identity and IoT/OT. We work only through MSP partners and never sell direct to end clients. To talk about how enhanced.io fits your stack, book a partnership conversation with Hannah Lloyd.