A China-nexus threat actor tracked as Armory Castle exploited a critical vulnerability in BeyondTrust Remote Support appliances as a zero-day starting on 29 August 2026. The flaw, CVE-2026-102764, scored 9.3 on CVSS and stemmed from an internal messaging component that did not properly validate the origin of incoming messages.
In the attack, researchers say Armory Castle deployed a custom PHP Webshell named “SAWFLY” just 11 minutes after weaponising the bug, then targeted the appliance’s built-in secrets management database to search for passwords, API keys and other credentials before dumping admin credentials.
The group established persistence with a script, deleted system, Web server and application logs to hinder forensics, escalated from a standard service account to full admin privileges, and used remote sessions to probe networks and exfiltrate sensitive documents. A second, new tool named “BARECLAW” was introduced for SOCKS5 tunnelling. Mandiant and Google’s Threat Intelligence Group described the operation as a display of deep knowledge of BeyondTrust’s internals.
BeyondTrust issued a patch for CVE-2026-102764 on 9 October 2026 and urged on‑premise customers to update promptly. The incident sits among a week of high-severity, edge-device flaws affecting Ivanti Connect Secure (CVE-2026-104935, pre-authentication chain including RCE and privilege escalation), Cisco SEG (CVE-2026-76519, arbitrary file write) and PAN-OS (CVE-2026-0322, high-severity RCE).
Researchers advised patching as a priority, isolating at‑risk appliances, restricting outbound traffic to vendor endpoints, and redeploying from clean images. Organisations were also encouraged to apply compensating controls such as network restrictions, credential hygiene, and restricting control plane permissions, with a focus on minimising exposure of internet‑facing management tools.