China-nexus Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from late August
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small number of impacted organizations are known, but GTIG warns that others may have been compromised before disclosure because the activity was stealthy and used a zero-day. Mandiant urged organizations to prepare for potential widespread exploitation, since the group and others have previously run broad, opportunistic exploitation after public vulnerability disclosures. The group has a history of edge-device zero-days, including multiple Ivanti flaws since 2023, the Citrix NetScaler zero-day known as CitrixBleed, and the Brickstorm campaign, which had an average dwell time of 400 days.
Detalhes técnicos
- BeyondTrust detected the activity after zero-days were confirmed exploited in another security vendor's product on Sept. 27. That timing matches a round of Citrix NetScaler zero-day disclosures. BeyondTrust did not say whether the two sets of attacks are linked.
- The actor reportedly escalated privileges, moved laterally and evaded detection inside compromised networks. The article gives no specific techniques.
- BeyondTrust says the actor rotates infrastructure and tooling for every victim, so attribution rests on behavior and indicators from one intrusion rarely carry over to the next.
- Armory Castle targets edge devices, which typically do not support EDR. This minimizes detection opportunities and supports stealthy, persistent access.
- Previous targets include business-process outsourcers, government, legal services, technology companies and SaaS providers. GTIG says there is not enough evidence to assess a current targeting trend.
- BeyondTrust declined to say how many customers are compromised or why the actively exploited zero-day was not disclosed sooner.
Remediação
- BeyondTrust released a patch for self-hosted customers on Oct. 8 and automatically updated cloud-based versions the same day.
- GTIG encourages all potentially vulnerable organizations to apply the patch and hunt for pre-disclosure activity.
Linha do tempo
-
China-nexus Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from late August
Adds BeyondTrust's detection and containment date of Sept. 28 and a patch date of Oct. 8 for self-hosted customers, with cloud versions updated the same day. It also adds GTIG's statement that only a small number of victims are known but more may exist, the timing overlap with the Sept. 27 Citrix NetScaler zero-day disclosures with no confirmed link, and the group's history of CitrixBleed, Ivanti and Brickstorm (400-day average dwell time). BeyondTrust declined to explain the delayed public disclosure, and Mandiant warns of potential widespread exploitation.
ler a análise desta fonte ocultar
Adds BeyondTrust's detection and containment date of Sept. 28 and a patch date of Oct. 8 for self-hosted customers, with cloud versions updated the same day. It also adds GTIG's statement that only a small number of victims are known but more may exist, the timing overlap with the Sept. 27 Citrix NetScaler zero-day disclosures with no confirmed link, and the group's history of CitrixBleed, Ivanti and Brickstorm (400-day average dwell time). BeyondTrust declined to explain the delayed public disclosure, and Mandiant warns of potential widespread exploitation.
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small number of impacted organizations are known, but GTIG warns that others may have been compromised before disclosure because the activity was stealthy and used a zero-day. Mandiant urged organizations to prepare for potential widespread exploitation, since the group and others have previously run broad, opportunistic exploitation after public vulnerability disclosures. The group has a history of edge-device zero-days, including multiple Ivanti flaws since 2023, the Citrix NetScaler zero-day known as CitrixBleed, and the Brickstorm campaign, which had an average dwell time of 400 days.
Technical Details
- BeyondTrust detected the activity after zero-days were confirmed exploited in another security vendor's product on Sept. 27. That timing matches a round of Citrix NetScaler zero-day disclosures. BeyondTrust did not say whether the two sets of attacks are linked.
- The actor reportedly escalated privileges, moved laterally and evaded detection inside compromised networks. The article gives no specific techniques.
- BeyondTrust says the actor rotates infrastructure and tooling for every victim, so attribution rests on behavior and indicators from one intrusion rarely carry over to the next.
- Armory Castle targets edge devices, which typically do not support EDR. This minimizes detection opportunities and supports stealthy, persistent access.
- Previous targets include business-process outsourcers, government, legal services, technology companies and SaaS providers. GTIG says there is not enough evidence to assess a current targeting trend.
- BeyondTrust declined to say how many customers are compromised or why the actively exploited zero-day was not disclosed sooner.
Remediation
- BeyondTrust released a patch for self-hosted customers on Oct. 8 and automatically updated cloud-based versions the same day.
- GTIG encourages all potentially vulnerable organizations to apply the patch and hunt for pre-disclosure activity.
-
China-nexus Armory Castle exploits BeyondTrust Remote Support zero-day CVE-2026-102764 to deploy SAWFLY web shell
ler a análise desta fonte ocultar
The China-nexus espionage group Armory Castle (formerly UNC5221 / Warp Panda) exploited CVE-2026-102764 (CVSS 9.3), an improper origin validation flaw in BeyondTrust Remote Support, as a zero-day. According to BeyondTrust's timeline, it hit a single self-hosted appliance on August 29, 2026. BeyondTrust began hunting for similar activity after another security device provider's exploitation became public on September 27. Mandiant/GTIG reports that the actor deploys the SAWFLY PHP web shell, gains root, steals stored secrets and pivots to downstream systems. CISA added the CVE to the KEV catalog with a federal remediation deadline of October 19, 2026. BeyondTrust warns that the actor typically moves to broad exploitation of all unpatched instances once a flaw is public.
Technical Details
- The flaw is in internal Remote Support messaging components that do not validate message origin, allowing a remote attacker to perform file operations on the appliance.
- Affected: self-hosted Remote Support versions 24.3.1 through 26.2.3. Older versions must be upgraded. SaaS customers were patched as of October 9, 2026.
- Post-exploitation begins with the SAWFLY lightweight PHP web shell, which provides interactive access and bidirectional encrypted C2. Persistence survives reboots.
- The actor routes traffic through commercial VPN exit nodes and compromised home and small-office routers.
- Root escalation: /bin/sh is copied to
/usr/bin/dbus-authdwith root ownership and SUID set. - Credential theft: the native
/ns/sbin/bt-secretsCLI is used to read stored passwords, API keys and endpoint credentials. BeyondTrust configuration templates are abused to obtain passwordless root for the site service account. - Lateral movement: compromised admin credentials are used to launch remote sessions to downstream systems in the Jump Item list, with full file-system access and document exfiltration.
- Tunneling: BARECLAW, a custom C-based SOCKS5 proxy tunneler, is exposed to the internet by modifying
/ns/config/haproxy.conf. - Defense evasion: system, web server and application logs are systematically deleted.
- Armory Castle previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure for long-term intelligence collection against legal, SaaS, BPO, technology and government targets. BeyondTrust assesses that the actor pre-selects high-value software targets and may use AI to model them and develop exploit chains.
Remediation
- Apply the BT26-05-RS patch (or upgrade, if running a version older than 24.3.1).
- Limit external access to the Remote Support appliance to required services only.
- Treat any internet-reachable vulnerable appliance as potentially compromised until reviewed.
- Conduct network and memory forensics, and hunt for unrecognized privileged or administrative sessions.
- Isolate suspected appliances and capture a VM snapshot or forensic image.
- Rebuild from a known-good state and then patch.