A suspected China state-backed actor, Armory Castle, exploited a newly disclosed critical vulnerability in BeyondTrust Remote Support, CVE-2026-102764, to gain access and escalate privileges on affected appliances. Google warns this allowed the group to establish persistent access, elevate from a web service account to root, and move laterally within compromised environments.
The attackers deployed Sawfly, an obfuscated PHP webshell with bidirectional encrypted C2 communication, and used the compromised system to copy the shell into /usr/bin/dbus-authd, set its ownership to root, and enable SUID to secure a persistent backdoor. They also targeted the appliance’s secrets management and configuration templates to grant passwordless root privileges to the site service account.
Evidence points to extensive post-exploitation activity designed to exfiltrate data and maintain control. Armory Castle reportedly harvested credentials from BeyondTrust’s native secrets database via the /ns/sbin/bt-secrets CLI utility, manipulated Jump Items and Team permissions to achieve unrestricted remote access, and used the file transfer service to exfiltrate internal documents. The group also deployed Bareclaw to tunnel traffic and systematically deleted logs to avoid detection.
BeyondTrust released a patch for SaaS and self-hosted deployments on 8 October, with Google urging immediate remediation and outlining defensive steps, including traffic controls, session termination, redeployment from clean images, and tightened authentication.