Threat reportVulnerabilityTL-2026-3668
ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support (CVE-2026-102764) with SAWFLY Webshell and BARECLAW Tunneler
ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote (TL-2026-3668), also tracked as UNC5221 BeyondTrust zero-day campaign, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-10-15. It is attributed to ARMORY CASTLE (China) with high confidence, affects BeyondTrust Remote Support (formerly Bomgar), references 3 CVEs (CVE-2026-102764, CVE-2023-46805, CVE-2024-21887), maps to 18 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 1ARMORY CASTLE
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3668
- Threat ID
- TL-2026-3668
- Also known as
- UNC5221 BeyondTrust zero-day campaign, BT26-05
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- ARMORY CASTLE
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- multiple verticals, enterprise it and remote support users
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote
Malware and tooling: BARECLAW, SAWFLY, BeyondTrust
How ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote works
Google Threat Intelligence Group and Mandiant report that ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor, exploited an unauthenticated arbitrary file upload flaw (CVE-2026-102764) in BeyondTrust Remote Support appliances as a zero-day in late August 2026. Post-exploitation used the custom SAWFLY PHP webshell and BARECLAW SOCKS5-over-WebSocket tunneler to extract Vault credentials, persist as root and move laterally through Jump Items. Patch BT26-05 is available.
Google Threat Intelligence Group (GTIG) and Mandiant disclosed on 2026-10-15 that ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221 and active since at least October 2023, exploited CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The flaw is described as an unauthenticated arbitrary file upload (NVD describes internal components that did not adequately validate the origin of messages they received, permitting file operations on the appliance; CWE-290) and affects all supported versions through 26.2.3. Evidence of exploitation resides in access, syslog, messages, thin_scc, brain and SSL logs on the appliance's LUKS-encrypted /home partition.
About 11 minutes after exploitation, the actor sent POST requests to a staging webshell at /app_84304470%2Ephp and dropped the SAWFLY PHP webshell (mangoapi.php) into the site service account's Laravel public directory (/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/). SAWFLY is a small obfuscated webshell running as an unprivileged service account: it returns HTTP 404 unless the POST parameter _c94mfe is present, then Base32-decodes the payload, RC4-decrypts it with a hardcoded 32-byte key, passes it to @eval(), and returns the result RC4-encrypted and Base32-encoded.
For privilege escalation the actor copied /bin/sh to /usr/bin/dbus-authd, chowned it to root and set mode 4755, creating a masqueraded SUID root shell. With root, the actor used the appliance's /ns/sbin/bt-secrets CLI to pull Vault secrets (passwords, API keys, endpoint and service-account credentials, Password Safe credentials) with three fallback invocations, then removed bt-secrets logs. Persistence was established via /home/bomgar/sbin/post_boot.d/zz-root-persist, which appends a NOPASSWD sudoers line for the site service account to /ns/config/sudoers.template and runs bt-sysconfig, surviving reboots and configuration resets.
BARECLAW (ingredi_ws) is a C SOCKS5-over-WebSocket tunneler embedding CivetWeb and OpenSSL, with optional token auth, XOR stream obfuscation (--obfs), CIDR allow-lists, upstream proxy chaining and quiet mode. It was launched from /tmp listening on TCP 19800 with WebSocket path /uidchanarge and exposed externally by editing /ns/config/haproxy.conf with an ACL (wswsws) routing path /uidchanarge to backend webskd3 at 127.0.0.1:19800 with a 5h tunnel timeout. The actor then deleted numerous appliance logs (auth, ssl, http, php-fpm, messages, etc.).
For lateral movement the actor logged into the /login interface with a password, changed a user's Jump Item and Team roles from No Access to Administrator (user_changed event), launched remote support sessions to internal endpoints and used the built-in file transfer service to download sensitive documents and software inventories. GTIG assesses with high confidence that, as with the actor's earlier Ivanti campaigns (CVE-2023-46805, CVE-2024-21887), widespread opportunistic exploitation will follow disclosure. BeyondTrust patched SaaS tenants on 2026-10-09; self-hosted customers on v24.3.1+ apply BT26-05-RS, and rebuilding from a clean image is recommended for potentially compromised appliances because persistence survives reboot and reset.
MITRE ATT&CK techniques used in TL-2026-3668
Collection
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion
Persistence
T1037 Boot or Logon Initialization Scripts; T1098 Account Manipulation; T1505.003 Server Software Component: Web Shell
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Command and Control
T1132 Data Encoding; T1219 Remote Access Tools; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography
Privilege Escalation
T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid; T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Credential Access
Affected products and versions in ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote
- BeyondTrust — Remote Support (formerly Bomgar)
Vulnerable versions: All supported versions through 26.2.3
Fixed in: Patch BT26-05-RS (self-hosted v24.3.1+); SaaS patched 2026-10-09
Remediation for ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote
Patches
- BeyondTrust BT26-05 / BT26-05-RS (self-hosted v24.3.1 and later; upgrade older versions first)
Immediate actions
- Apply BT26-05 / BT26-05-RS on self-hosted Remote Support via /appliance (SaaS tenants were patched 2026-10-09)
- Preserve evidence first: snapshot virtual appliances with memory, request forensic preservation for B Series/SaaS, collect syslog, reverse-proxy/WAF and perimeter firewall logs
- Block inbound traffic to potentially compromised appliances at the perimeter firewall and deny egress except to BeyondTrust endpoints
- End active support sessions; disable (do not delete) Jump Clients, Jumpoints and API accounts
- Hunt for requests to /app_84304470%2Ephp and /uidchanarge, mangoapi.php, ingredi_ws, /usr/bin/dbus-authd SUID, zz-root-persist and haproxy.conf backend webskd3
Workarounds
- Restrict /login and /appliance interfaces by IP/network segment; allow only representative console, customer portal and Jump Client traffic
- Deploy a WAF/reverse proxy and alert on unknown .php paths and WebSocket upgrades from non-endpoint ranges
Longer-term hardening
- Rebuild potentially compromised appliances from a clean fully patched image and redeploy Jump Clients, Jumpoints and consoles
- Rotate credentials only after patching/rebuild: /appliance admin, /login users, API secrets, security-provider bind accounts, SAML signing keys, Vault, Password Safe/PRA, integration credentials, and anything typed into sessions during the exposure window
- Require SAML SSO with phishing-resistant MFA; keep one vaulted break-glass local account with alerting
- Set default Jump Item role to No Access and grant roles by policy; scope API accounts to minimum permissions
- Forward appliance syslog to a SIEM over TLS and alert on forwarding gaps bounded by a single session
- Default-deny outbound filtering from the appliance; place a reverse proxy/WAF with full URI logging in front
CVEs associated with ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote
Weaknesses (CWE) in ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote
Timeline of ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote
- ARMORY CASTLE (formerly UNC5221) activity begins as early as October 2023, later including Ivanti zero-days CVE-2023-46805 and CVE-2024-21887 (day of month approximate; source states month only).
- Approximately 11 minutes after exploitation, POSTs to /app_84304470%2Ephp stage the SAWFLY webshell mangoapi.php; actor then escalates to root via SUID /usr/bin/dbus-authd, extracts Vault secrets with bt-secrets and installs zz-root-persist (date approximate).
- ARMORY CASTLE exploits CVE-2026-102764 in BeyondTrust Remote Support as a zero-day in late August 2026 (exact day not stated in source; date approximate).
- Post-exploitation phase: BARECLAW (ingredi_ws) tunneler exposed via HAProxy path /uidchanarge, appliance logs deleted, Jump Item roles elevated and remote sessions/file transfers used against internal endpoints (sequence per report; date approximate).
- BeyondTrust patches Remote Support SaaS tenants for CVE-2026-102764.
- GTIG/Mandiant publish analysis; BeyondTrust advisory BT26-05 and NVD entry for CVE-2026-102764 published; patch BT26-05-RS available for self-hosted v24.3.1+.
Sources cited for ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote
- ARMORY CASTLE Exploits BeyondTrust (Google Threat Intelligence Group / Mandiant)
- BeyondTrust Security Advisory BT26-05
- BeyondTrust Blog: BT26-05
- NVD: CVE-2026-102764
- GTI VirusTotal Collection for ARMORY CASTLE BeyondTrust activity
- BeyondTrust Remote Support Two-Factor Authentication documentation
- Mandiant: China-nexus exploiting critical Ivanti vulnerability (prior ARMORY CASTLE/UNC5221 activity)
- Mandiant: Ivanti Connect Secure VPN zero-day (CVE-2023-46805, CVE-2024-21887)
Detection coverage for TL-2026-3668
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3668 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.