A China-linked cyber espionage group tracked as Armory Castle, previously known as UNC5221 or Warp Panda, exploited a recently disclosed zero-day vulnerability in BeyondTrust Remote Support to compromise a self-hosted appliance in August 2026.
The vulnerability, tracked as CVE-2026-102764 with a CVSS severity score of 9.3, affects an internal messaging component in BeyondTrust Remote Support, formerly known as Bomgar. The flaw stems from improper origin validation and could allow a remote attacker to perform file operations on a vulnerable appliance under certain conditions.
According to BeyondTrust, the affected components failed to adequately validate the origin of incoming messages, potentially enabling attackers to manipulate files on the appliance.
The incident highlights the risks posed by vulnerabilities in remote support platforms, which often have privileged access to internal systems and can provide attackers with a pathway into enterprise networks.
BeyondTrust Releases Patch for Critical Vulnerability
BeyondTrust has addressed CVE-2026-102764 and confirmed that patches were deployed to all Remote Support software-as-a-service (SaaS) customers as of October 9, 2026.
Organizations operating self-hosted installations require additional action to secure their environments.
BeyondTrust recommends that customers running Remote Support versions 24.3.1 through 26.2.3 manually install the BT26-05-RS patch. Customers running versions earlier than 24.3.1 must upgrade to a supported version before applying the fix.
Because the vulnerability has been exploited in the wild, organizations should prioritize remediation, particularly if their Remote Support appliances were accessible from the internet during the attack window.
Armory Castle Exploited the Flaw as a Zero-Day
According to a timeline published by BeyondTrust, Armory Castle exploited the vulnerability on August 29, 2026, against a single self-hosted Remote Support appliance.
The company subsequently began investigating the incident after another security device vendor disclosed successful exploitation activity on September 27, 2026. The disclosure prompted BeyondTrust to search for similar activity affecting its own products.
Armory Castle has a history of exploiting previously unknown or newly disclosed vulnerabilities in enterprise security appliances to gain access to high-value targets.
Its previous targets have included Citrix NetScaler appliances affected by CVE-2023-4966 and Ivanti Connect Secure appliances affected by CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282.
The group has reportedly been active since October 2023 and has targeted organizations across several industries, including legal services, software-as-a-service providers, business-process outsourcing, technology companies, and government entities. Its operations are primarily focused on long-term intelligence collection.
BeyondTrust noted that the threat actor appears to use a selective exploitation strategy. It initially deploys zero-day exploits against chosen targets, then may expand its operations to other vulnerable systems once the underlying flaw becomes public.
The company also assessed that the group may maintain an ongoing understanding of high-value software products and use AI-assisted workflows to develop and refine exploit chains. This remains a working assessment rather than a confirmed explanation of the group’s internal processes.
Attackers Deploy SAWFLY Web Shell for Remote Access
Google-owned Mandiant and the Google Threat Intelligence Group (GTIG) investigated the activity and reported that successful exploitation was followed by the deployment of a lightweight PHP web shell tracked as SAWFLY.
The web shell provided interactive remote access and supported encrypted, two-way command-and-control (C2) communications, allowing the attackers to maintain contact with compromised appliances.
To conceal their activity, the operators reportedly routed connections through commercial VPN exit nodes and compromised home and small-office routers. This infrastructure helped their traffic blend in with legitimate network activity.
Once access was established, the attackers used the web shell as a foothold to escalate privileges, obtain administrative control of the appliance, steal credentials, and establish persistence designed to survive system reboots.
The compromise also enabled the threat actor to exploit the appliance’s legitimate remote support functionality to reach other systems within the victim’s network.
How Armory Castle Escalated Privileges and Stole Credentials
Investigators identified several post-exploitation techniques that demonstrate the group’s familiarity with BeyondTrust appliance internals.
1. Obtaining Root-Level Access
The attackers reportedly copied the system shell executable /bin/sh to /usr/bin/dbus-authd, changed its ownership to root, and enabled Set User ID (SUID) permissions.
This modification could cause the copied executable to run with the privileges of its file owner, providing a route to root-level access on the appliance.
2. Harvesting Stored Credentials and Secrets
The threat actor attempted to extract credentials directly from the appliance’s native secrets management database.
To do so, the attackers used BeyondTrust’s proprietary /ns/sbin/bt-secrets command-line utility, which is designed to manage, store, and retrieve sensitive information such as passwords, API keys, and endpoint credentials.
Access to these secrets could expose additional systems and services connected to the compromised environment.
3. Abusing Configuration Templates
The attackers also targeted BeyondTrust configuration templates to obtain passwordless root privileges for the site service account.
This activity indicates that the operators understood how the appliance’s internal configuration mechanisms could be abused to increase their level of access.
4. Using Administrator Credentials to Access Internal Systems
After compromising the appliance, the attackers used stolen administrator credentials to conduct reconnaissance within the BeyondTrust Remote Support application.
They then initiated remote support sessions to downstream systems listed in the appliance’s Jump Item inventory.
These sessions could provide access to internal endpoints and their file systems, enabling the attackers to collect sensitive documents and gather additional information about the victim’s network.
5. Establishing a Network Tunnel With BARECLAW
The attackers deployed a custom C-based SOCKS5 proxy tunneler tracked as BARECLAW.
The tool relayed TCP connections between a remote client and internal destinations, allowing the operators to route traffic through the compromised BeyondTrust appliance.
The attackers also modified the /ns/config/haproxy.conf configuration file to make BARECLAW accessible directly from the internet.
This created another channel through which the threat actor could reach internal systems and move through the victim’s network.
6. Deleting Logs to Conceal Activity
To hinder forensic investigations and detection, Armory Castle systematically deleted logs from the system, web server, and application layers.
The removal of these records could make it more difficult for defenders to reconstruct the intrusion timeline, identify compromised accounts, and determine which internal systems had been accessed.
Researchers Warn of Deep Knowledge of BeyondTrust Appliances
Mandiant and GTIG researchers said the intrusion demonstrated a detailed understanding of BeyondTrust’s internal architecture.
The attackers’ use of proprietary command-line utilities, startup configuration templates, and local reverse-proxy routing mechanisms indicated familiarity with the appliance’s underlying components.
Researchers warned that any appliance running a vulnerable version and reachable from the internet during the exploitation window should be considered potentially compromised until a thorough investigation establishes otherwise.
This warning is particularly important because patching a vulnerable appliance does not necessarily remove web shells, unauthorized accounts, modified configuration files, or other persistence mechanisms left behind by an attacker.
CISA Issues Urgent Guidance for BeyondTrust Customers
On October 16, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory urging organizations using affected BeyondTrust Remote Support deployments to take immediate protective measures.
The agency recommended the following actions:
- Apply the security patch: Install the BT26-05-RS patch to address CVE-2026-102764.
- Restrict external access: Limit internet exposure of Remote Support appliances to only the services and connections required for business operations.
- Conduct forensic investigations: Perform network and memory forensics to identify evidence of exploitation or unauthorized access.
- Isolate compromised systems: Disconnect suspected or confirmed compromised appliances from the network to prevent further attacker activity.
- Investigate suspicious activity: Search for indicators of compromise, including unfamiliar privileged accounts, unauthorized administrative sessions, unexpected web shells, and altered configuration files.
- Preserve forensic evidence: Capture snapshots of virtual appliances or forensic images of physical appliances before undertaking remediation, where feasible.
- Rebuild affected appliances: Restore compromised systems from a known-good state and apply the required security patch.
CISA also added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that the flaw is associated with exploitation activity.
Federal Civilian Executive Branch (FCEB) agencies were required to apply the relevant fixes by October 19, 2026.
What Organizations Should Do Next
Organizations using BeyondTrust Remote Support should treat this incident as both a patching priority and a potential security breach.
Administrators should first identify affected appliances, verify the installed software versions, and apply the appropriate update. They should then review available logs, network telemetry, memory artifacts, configuration changes, and authentication records for evidence of compromise.
Particular attention should be paid to unexpected privileged sessions, suspicious PHP files, changes to HAProxy configuration, unauthorized SUID executables, and evidence of outbound connections through unfamiliar VPN infrastructure.
If an appliance was exposed to the internet while running a vulnerable version, security teams should investigate whether the attacker accessed stored credentials or used the appliance to reach downstream systems. Potentially exposed passwords, API keys, service credentials, and access tokens should be rotated from a trusted environment.
Where compromise is confirmed or cannot be ruled out, rebuilding the appliance from a known-good state may be necessary. Organizations should also investigate connected endpoints because the remote support platform may have served as an entry point for broader network access.
Conclusion
The Armory Castle campaign underscores the growing threat posed by sophisticated cyber espionage groups targeting enterprise security appliances. By exploiting CVE-2026-102764 as a zero-day, deploying the SAWFLY web shell, and using BARECLAW to tunnel traffic, the attackers established remote access and attempted to steal credentials while expanding their reach into internal networks.
The incident also demonstrates why patching alone is not always sufficient after a suspected breach. Organizations must combine rapid vulnerability remediation with forensic investigation, credential rotation, persistence checks, and a thorough assessment of connected systems.
With CISA adding the vulnerability to its Known Exploited Vulnerabilities catalog, organizations running BeyondTrust Remote Support should prioritize patching and investigate potentially exposed appliances without delay.
