China-nexus Armory Castle exploited BeyondTrust Remote Support flaw CVE-2026-102764 as zero-day since August 2026

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 16/10/2026 07:10 · coletado 20/10 16:31

   China-nexus Armory Castle exploited BeyondTrust Remote Support flaw CVE-2026-102764 as zero-day since August 2026

   Google attributes exploitation of CVE-2026-102764 to the suspected China state-sponsored actor Armory Castle, with exploitation dating to August 2026, before the October 15 disclosure. It adds the actor's tooling (Sawfly PHP webshell, Bareclaw tunneler), the SUID root backdoor at /usr/bin/dbus-authd, secrets harvesting via bt-secrets, configuration template and Jump Item permission tampering, log deletion, and detailed containment guidance. It also notes the patch was released on October 8 and gives the target sectors.

   ler a análise desta fonte ocultar

   Google attributes exploitation of CVE-2026-102764 to the suspected China state-sponsored actor Armory Castle, with exploitation dating to August 2026, before the October 15 disclosure. It adds the actor's tooling (Sawfly PHP webshell, Bareclaw tunneler), the SUID root backdoor at /usr/bin/dbus-authd, secrets harvesting via bt-secrets, configuration template and Jump Item permission tampering, log deletion, and detailed containment guidance. It also notes the patch was released on October 8 and gives the target sectors.

   Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances. A patch was released on October 8 for SaaS and self-hosted customers, and technical details are being withheld while patching continues. Google expects broad, opportunistic exploitation by Armory Castle and other actors now that the flaw is public, and assesses with high confidence that the group will keep using zero-days in edge devices. Armory Castle has been active since October 2023 and targets legal services, SaaS providers, business-process outsourcers, technology companies and government.

   Technical Details

   • Post-exploitation was tailored to BeyondTrust internals: abuse of proprietary CLI utilities, startup configuration templates and local reverse-proxy routing.
   • The actor deployed Sawfly, an obfuscated, lightweight PHP webshell with bidirectional encrypted C2.
   • Privilege escalation: the webshell copied the system shell to /usr/bin/dbus-authd, set root ownership and enabled SUID, giving a persistent root backdoor.
   • Credential theft: the actor tried to harvest secrets from the native secrets database via the /ns/sbin/bt-secrets CLI utility.
   • Persistence: BeyondTrust configuration templates were modified to grant passwordless root to the site service account. Local Jump Items and Team permissions were raised from 'No Access' to 'Administrator', allowing remote sessions to downstream systems.
   • Collection: the native Remote Support file transfer service was used to exfiltrate internal documents such as software inventories.
   • Tunneling: the Bareclaw tunneler moved traffic through the appliance.
   • Defense evasion: system, web server and application logs were systematically deleted.

   Remediation

   • Apply the BeyondTrust patch for CVE-2026-102764 immediately, and preserve telemetry before taking containment actions.
   • Block inbound traffic to the appliance's public address at the firewall, and deny outbound traffic except to BeyondTrust update and licensing endpoints, logging every denied connection.
   • Restrict /login and /appliance administrative interfaces by IP or network segment.
   • End active support sessions and disable new sessions, Jump Clients, Jumpoints and API accounts.
   • Redeploy appliances with confirmed or unknown compromise status from a clean, fully patched image. Then redeploy Jump Clients, Jumpoints and the representative console to invalidate existing tokens.
   • Rotate credentials in dependency order and enforce MFA on the built-in Admin account.
2. cisa.gov ↗ · pub. 16/10/2026 09:00 · coletado 19/10 18:37 primeiro registro

   CISA adds BeyondTrust Remote Support auth bypass CVE-2026-102764 to KEV after active exploitation

   ler a análise desta fonte ocultar

   CISA has warned of a critical authentication bypass, CVE-2026-102764, in BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Threat actors are actively exploiting it to gain initial access, establish persistence, escalate privileges and move laterally. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 16 October 2026. BeyondTrust-hosted (SaaS) deployments are already patched, so the exposure is limited to self-hosted appliances.

   Technical Details

   • The flaw is an authentication bypass in self-hosted Remote Support appliances (26.2.3 and earlier). Patches cover supported versions 24.3.1 and later, so older installs must upgrade first.
   • Reported post-exploitation activity includes persistence, privilege escalation and lateral movement.
   • Hunt indicators named by CISA: unrecognized privileged or administrative sessions, unrecognized script files, unexpected gaps in logs or log forwarding, and unauthorized account, permission or session-policy changes.
   • CISA points to BeyondTrust's blog on ARMORY CASTLE and BT26-05, and to Mandiant's blog "ARMORY CASTLE Exploits BeyondTrust", for detections and hunt guidance. The article does not give IOCs or attribution.

   Remediation

   • Apply the BT26-05-RS patch described in BeyondTrust Security Advisory BT26-05, upgrading first if the version is older than 24.3.1.
   • Limit external access to the appliance to the services needed, and restrict administrative interfaces to trusted networks.
   • Run network and memory forensics on affected self-hosted appliances.
   • If compromise is suspected, isolate the appliance. Take a snapshot or forensic image, forward syslog and session events to the SIEM, and collect WAF, reverse-proxy and perimeter firewall logs for the exposure window.
   • Rebuild from a known-good state and apply the patch. Then rotate every credential the appliance stored or injected, revoke all active support sessions, and review new MFA registrations on privileged accounts.