Armory Castle escalates BeyondTrust zero-day exploitation with credential theft and lateral movement

This is a new development in a story we reported earlier: China-linked Armory Castle hijacks BeyondTrust Remote Support Servers via zero-day since August.

Since BeyondTrust disclosed CVE-2026-102764 on October 15, 2026—a zero-day exploited by the China-linked Armory Castle group in late August—the threat actor has expanded its operations on compromised Remote Support appliances. BeyondTrust released a patch for the flaw, rated 9.3 on the CVSS scale, on October 8, but Armory Castle has since deployed multiple persistence mechanisms, credential-harvesting tools and lateral-movement techniques.

Armory Castle established a foothold using the Sawfly PHP webshell, enabling bidirectional encrypted command-and-control on compromised appliances. The group then leveraged BeyondTrust’s bt-secrets CLI utility to attempt harvesting credentials from the appliance’s secrets management database, according to multiple reports. Researchers also observed the threat actor systematically deleting system, web server and application-level logs to hinder detection and forensic analysis.

To maintain access, Armory Castle copied the /bin/sh binary to /usr/bin/dbus-authd, changed its ownership to root and set the SUID bit, granting root-level privileges. The group then created a startup script named zz-root-persist, which added the site service account to the sudoers template with passwordless root privileges. These steps align with Armory Castle’s established tactics for achieving long-term control over compromised systems.

Beyond persistence, Armory Castle used the Bareclaw SOCKS5 tunneler over WebSocket to relay traffic through the compromised BeyondTrust device, enabling covert communication. The group also exploited the appliance’s native file-transfer service to download and exfiltrate internal documents, including software inventories, for network reconnaissance. By modifying a compromised admin account’s Jump Items and Team permissions to Administrator, Armory Castle enabled remote sessions to downstream systems, expanding its reach within targeted environments.

Google warned organizations to prepare for widespread exploitation after the vulnerability’s disclosure, citing Armory Castle’s history of broad, opportunistic attacks once flaws become public. The tech giant assessed with high confidence that the group will continue to exploit zero-day vulnerabilities in edge devices to support its espionage objectives. This pattern suggests Armory Castle’s operations may evolve from targeted intrusions to broader campaigns against unpatched systems, particularly in remote-support tools widely deployed across enterprises.