Armory Castle exploited BeyondTrust Remote Support zero-day to seize root and pivot downstream

China-nexus espionage group Armory Castle, previously tracked as UNC5221 and Warp Panda, exploited a previously unknown flaw in BeyondTrust Remote Support to take root on appliances, harvest their stored credentials and open remote sessions into the very systems those appliances were built to manage, according to a RedEye Security analysis republished on dev.to.

The vulnerability, CVE-2026-102764, carries a CVSS score of 9.3. BeyondTrust said an internal messaging component failed to properly check the origin of incoming messages, and that under certain conditions this enabled file operations on the appliance — a short step from code execution for an attacker. The first confirmed exploitation hit a self-hosted appliance on August 29, 2026. The vendor finished patching its SaaS tenants on October 9, roughly six weeks later, and published its alert on October 15.

The intrusion chain

Google Threat Intelligence Group and Mandiant documented what followed initial access. The operator connected through commercial VPN exit nodes and compromised home and small-office routers so the traffic looked routine, then deployed SAWFLY, a lightweight PHP web shell with interactive access and encrypted two-way command and control.

The post-exploitation work showed unusual familiarity with the product. The attacker obtained a root shell by copying /bin/sh to /usr/bin/dbus-authd with the SUID bit set — a filename that resembles a legitimate system service — and used the proprietary /ns/sbin/bt-secrets tool to pull passwords, API keys and endpoint credentials from the appliance's native secrets store. BeyondTrust configuration templates were abused to give the site service account root access without a password.

With administrator credentials taken from the appliance, the group logged into Remote Support, ran reconnaissance and opened sessions to downstream systems in the product's Jump Item list, gaining full access to those endpoints' file systems and exfiltrating internal documents for network mapping. For persistent access they deployed BARECLAW, a custom SOCKS5 proxy tunneller written in C, and edited /ns/config/haproxy.conf so it could be reached directly from the internet. System, web server and application logs were then systematically wiped.

An indirect discovery

According to BeyondTrust's timeline, the vendor only went looking after September 27, 2026, when exploitation at another security device provider became public. That hunt surfaced the August 29 intrusion, meaning the appliance had been compromised for about a month before the vendor knew, and the patch rollout took nearly two more weeks.

A repeat pattern

Armory Castle has been active since at least October 2023, with prior zero-day campaigns against Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282). Its victims include legal services firms, SaaS providers, business-process outsourcers, technology companies and governments, and the aim is gathering intelligence over time rather than causing disruption. BeyondTrust described a pattern of using a zero-day selectively against chosen targets, then switching to broad exploitation of every unpatched instance once the flaw is public. The vendor also said its working assessment is that the actor keeps a model of each target product in an AI context to speed up exploit development, though this remains the vendor's own assessment.

Patch and investigate

SaaS customers were fixed automatically by October 9, 2026. Self-hosted deployments on versions 24.3.1 through 26.2.3 must apply patch BT26-05-RS manually, and anything older than 24.3.1 has to upgrade to a supported release before the fix can be installed.

Mandiant's guidance is that any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed: the group's persistence survives reboots, so a patched appliance can still be hosting the SAWFLY shell, the SUID backdoor or the BARECLAW tunneller. Published indicators include the file /usr/bin/dbus-authd, unexplained changes to /ns/config/haproxy.conf, use of bt-secrets outside normal administration, and gaps in appliance logs. Any credential stored on an exposed appliance during the window, including those for downstream Jump Item systems, should be considered lost.

Why it matters

A remote support appliance is trusted to reach everything — servers, workstations, network gear and, for managed service providers and outsourcers, entire customer environments. An attacker with root on the appliance and administrator rights in the application needs no conventional lateral movement; they can use the product as designed, through sessions that look like ordinary support work to most monitoring tools. With the CVE and patch now public and the group's record of mass exploitation after disclosure, any unpatched internet-facing Remote Support instance should be presumed to be a target. Organizations that ran an exposed instance between late August and their patch date face a compromise review, not just a patch ticket.