# ARMORY CASTLE Zero-Day Exploitation of BeyondTrust Remote Support (CVE-2026-102764) with SAWFLY Webshell and BARECLAW Tunneler

> Google Threat Intelligence Group and Mandiant report that ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus espionage actor, exploited an unauthenticated arbitrary file upload flaw (CVE-2026-102764) in BeyondTrust Remote Support appliances as a zero-day in late August 2026. Post-exploitation used the custom SAWFLY PHP webshell and BARECLAW SOCKS5-over-WebSocket tunneler to extract Vault credentials, persist as root and move laterally through Jump Items. Patch BT26-05 is available.

- **Published:** 2026-10-15T21:38:32Z
- **Last reviewed:** 2026-10-15T21:38:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3668
- **ID:** TL-2026-3668
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** ARMORY CASTLE (China)
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-102764, CVE-2023-46805, CVE-2024-21887

## Description

Google Threat Intelligence Group (GTIG) and Mandiant disclosed on 2026-10-15 that ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221 and active since at least October 2023, exploited CVE-2026-102764 in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The flaw is described as an unauthenticated arbitrary file upload (NVD describes internal components that did not adequately validate the origin of messages they received, permitting file operations on the appliance; CWE-290) and affects all supported versions through 26.2.3. Evidence of exploitation resides in access, syslog, messages, thin_scc, brain and SSL logs on the appliance's LUKS-encrypted /home partition.

About 11 minutes after exploitation, the actor sent POST requests to a staging webshell at /app_84304470%2Ephp and dropped the SAWFLY PHP webshell (mangoapi.php) into the site service account's Laravel public directory (/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/). SAWFLY is a small obfuscated webshell running as an unprivileged service account: it returns HTTP 404 unless the POST parameter _c94mfe is present, then Base32-decodes the payload, RC4-decrypts it with a hardcoded 32-byte key, passes it to @eval(), and returns the result RC4-encrypted and Base32-encoded.

For privilege escalation the actor copied /bin/sh to /usr/bin/dbus-authd, chowned it to root and set mode 4755, creating a masqueraded SUID root shell. With root, the actor used the appliance's /ns/sbin/bt-secrets CLI to pull Vault secrets (passwords, API keys, endpoint and service-account credentials, Password Safe credentials) with three fallback invocations, then removed bt-secrets logs. Persistence was established via /home/bomgar/sbin/post_boot.d/zz-root-persist, which appends a NOPASSWD sudoers line for the site service account to /ns/config/sudoers.template and runs bt-sysconfig, surviving reboots and configuration resets.

BARECLAW (ingredi_ws) is a C SOCKS5-over-WebSocket tunneler embedding CivetWeb and OpenSSL, with optional token auth, XOR stream obfuscation (--obfs), CIDR allow-lists, upstream proxy chaining and quiet mode. It was launched from /tmp listening on TCP 19800 with WebSocket path /uidchanarge and exposed externally by editing /ns/config/haproxy.conf with an ACL (wswsws) routing path /uidchanarge to backend webskd3 at 127.0.0.1:19800 with a 5h tunnel timeout. The actor then deleted numerous appliance logs (auth, ssl, http, php-fpm, messages, etc.).

For lateral movement the actor logged into the /login interface with a password, changed a user's Jump Item and Team roles from No Access to Administrator (user_changed event), launched remote support sessions to internal endpoints and used the built-in file transfer service to download sensitive documents and software inventories. GTIG assesses with high confidence that, as with the actor's earlier Ivanti campaigns (CVE-2023-46805, CVE-2024-21887), widespread opportunistic exploitation will follow disclosure. BeyondTrust patched SaaS tenants on 2026-10-09; self-hosted customers on v24.3.1+ apply BT26-05-RS, and rebuilding from a clean image is recommended for potentially compromised appliances because persistence survives reboot and reset.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1505.003 Server Software Component: Web Shell
- T1037 Boot or Logon Initialization Scripts
- T1098 Account Manipulation
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1070.004 Indicator Removal: File Deletion
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1021 Remote Services
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1132 Data Encoding
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1005 Data from Local System

## Sources

- [ARMORY CASTLE Exploits BeyondTrust (Google Threat Intelligence Group / Mandiant)](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/)
- [BeyondTrust Security Advisory BT26-05](https://www.beyondtrust.com/trust-center/security-advisories/bt26-05)
- [BeyondTrust Blog: BT26-05](https://www.beyondtrust.com/blog/entry/bt26-05)
- [NVD: CVE-2026-102764](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-102764)
- [GTI VirusTotal Collection for ARMORY CASTLE BeyondTrust activity](https://www.virustotal.com/gui/collection/194e0cb2a231aaf8e6b4bee93437c85b434dda7e327a5f483b79f7ff5bfcaa5e)
- [BeyondTrust Remote Support Two-Factor Authentication documentation](https://docs.beyondtrust.com/rs/docs/two-factor-authentication)
- [Mandiant: China-nexus exploiting critical Ivanti vulnerability (prior ARMORY CASTLE/UNC5221 activity)](https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability)
- [Mandiant: Ivanti Connect Secure VPN zero-day (CVE-2023-46805, CVE-2024-21887)](https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3668