Armory Castle Used BeyondTrust Remote Support Zero-Day
China-linked cyber-espionage group Armory Castle exploited CVE-2026-102764, a critical flaw in BeyondTrust Remote Support, as a zero-day against a self-hosted appliance on August 29, 2026. The vulnerability carries a CVSS score of 9.3 and affected Remote Support, formerly known as Bomgar.
BeyondTrust said it had pushed fixes to all Remote Support SaaS customers by October 9. Self-hosted deployments running versions 24.3.1 through 26.2.3 must manually install the BT26-05-RS patch, while customers on versions older than 24.3.1 must first upgrade to a version that can receive the fix.
Improper message validation enabled appliance file operations
The issue lies in internal Remote Support messaging components that did not adequately validate where received messages originated. Under the right conditions, a remote attacker could use that weakness to perform file operations on an affected appliance.
BeyondTrust began looking for related activity after successful exploitation of another security-device provider became public on September 27. Its timeline identifies a single self-hosted Remote Support appliance as having been exploited by Armory Castle before the flaw was disclosed.
The group, also tracked as UNC5221 and Warp Panda, has been active since October 2023. BeyondTrust said the actor selectively uses zero-days against chosen targets, then typically moves to broad exploitation of still-unpatched instances once a vulnerability becomes public.
Post-compromise activity targeted credentials and internal systems
Google-owned Mandiant reported that successful exploitation was followed by deployment of SAWFLY, a lightweight PHP web shell used for interactive access and encrypted bidirectional command-and-control communications. Operators used commercial VPN exit nodes and compromised home and small-office routers to blend into normal traffic.
Mandiant said the attackers used SAWFLY to escalate privileges, gain full administrative control and establish persistence that survived reboots. They copied /bin/sh to /usr/bin/dbus-authd, changed its ownership to root and enabled SUID permissions, allowing the file to run with the owner’s privileges.
The operation also attempted to retrieve passwords, API keys and endpoint credentials from the appliance secrets database through the proprietary /ns/sbin/bt-secrets CLI utility. The attackers targeted configuration templates for passwordless root privileges, used compromised administrator credentials to inspect the Remote Support application, and launched sessions to downstream systems listed as Jump Items.
For network access, the group deployed BARECLAW, a custom C-based SOCKS5 proxy tunneler, and modified /ns/config/haproxy.conf so it could be reached directly from the internet. It also deleted system, web-server and application logs to hinder detection.
Review exposed appliances as potentially compromised
Google Threat Intelligence Group and Mandiant said the activity demonstrated a deep understanding of BeyondTrust appliance internals, including proprietary CLI utilities, startup configuration templates and local reverse-proxy routing. The attackers used elevated administrative privileges to open remote-support sessions to internal endpoints and obtain full file-system access, with the stated aim of downloading sensitive documents for reconnaissance.
Businesses with a Remote Support appliance reachable from the internet on a vulnerable version during the exploitation window should not treat patching as sufficient remediation. The practical priority is to update or upgrade immediately, identify exposed appliances, and review them for the described persistence, web-shell, credential-access, proxy and log-deletion activity before trusting their administrative access or downstream connections.