GOOGLE Threat Intelligence Group and Mandiant say the suspected PRC-linked espionage group ARMORY CASTLE, formerly tracked as UNC5221, exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 as a zero-day in late August 2026. BeyondTrust disclosed the flaw on 15 October.
It affects supported Remote Support versions up to 26.2.3 and allows an unauthenticated remote attacker to carry out file operations on an appliance, potentially leading to control of the host and access to credentials stored or brokered by it. Mandiant found evidence of exploitation in appliance logs, but warned that attackers deleted logs, making external records important.
The researchers say the actor used its knowledge of the appliance’s internal tools and configuration to gain root access, steal credentials, maintain access and move towards internal systems.
After exploiting the flaw, ARMORY CASTLE installed SAWFLY, an obfuscated PHP webshell, and used a SUID-enabled copy of `/bin/sh` to obtain root privileges. Mandiant also observed attempts to extract credentials from BeyondTrust’s secrets-management database, changes that granted passwordless root access and administrator permissions, and the deletion of system and application logs. The group deployed BARECLAW, a custom SOCKS5 tunneller, and altered HAProxy settings to route external traffic to it.
Through the appliance, it accessed internal endpoints and transferred documents, including software inventories. Mandiant recommends immediately applying BeyondTrust’s BT26-05 patch. SaaS tenants were patched on 9 October 2026; self-hosted customers should patch or upgrade as appropriate.
Organisations whose vulnerable appliances were internet-accessible during the exposure window should treat them as potentially compromised, preserve external logs and evidence, and review or rebuild affected appliances before rotating credentials.