CHINA-LINKED threat group Armory Castle, also known as UNC5221 or Warp Panda, exploited a zero-day in BeyondTrust Remote Support (formerly Bomgar) to compromise a self-hosted appliance in late August 2026. The flaw, tracked as CVE-2026-102764, is rated 9.3 on the CVSS and stems from improper origin validation in an internal messaging component, allowing a remote attacker to perform file operations on affected devices.
BeyondTrust released patches for Remote Support SaaS customers by 9 October 2026, and self-hosted users on versions 24.3.1 through 26.2.3 were instructed to manually upgrade to BT26-05-RS; those on versions older than 24.3.1 needed a newer build before the patch could be applied.
Mandiant, via Google Threat Intelligence Group, states that Armory Castle used the flaw as a zero-day against a single self-hosted appliance on 29 August 2026, with public exploitation of another device provider appearing on 27 September 2026, prompting an investigation. Once inside, the group deployed SAWFLY, a lightweight PHP web shell, to establish interactive remote access and bidirectional encrypted C2 traffic.
The operation blended into normal traffic by using commercial VPN exit nodes and compromised home/SME routers, and then leveraged the web shell to escalate privileges, obtain full administrative control, and maintain persistence across reboots.
Post-exploitation actions included credential theft from the appliance’s secrets store, targeting configuration templates to obtain passwordless root access, pivoting to other systems via compromised administrator credentials, establishing remote sessions to downstream endpoints, and tunnelling traffic through the device using BARECLAW, a custom SOCKS5 proxy.
The intrusion was further marked by log deletion to hinder detection, with researchers noting Armory Castle’s deep knowledge of BeyondTrust internals and utilities. Any reachable, vulnerable appliance during the exploitation window should be treated as potentially compromised until reviewed.