BeyondTrust suspects Armory Castle uses AI to model target products for exploit development

Armory Castle, tracked as UNC5221 and Warp Panda, began exploiting BeyondTrust’s zero-day vulnerability CVE-2026-102764 in Remote Support appliances on August 29, 2026. The flaw is an authentication bypass affecting Remote Support versions 26.2.3 and earlier, rated 9.3 on CVSS 4.0, according to CSO Online.

BeyondTrust released patch BT26-05-RS on October 8, 2026, updating SaaS Remote Support and Privileged Remote Access instances; self‑hosted customers must apply the fix manually, according to CSO Online. SaaS customers received the patch automatically on October 8, while self‑hosted appliances running versions 24.3.1 through 26.2.3 can install BT26-05‑RS via the interface; older releases require an upgrade first, according to CSO Online.

The exploit chain started with a PHP web shell named SAWFLY appearing 11 minutes after the first malicious request, giving the attacker initial access, according to CSO Online. To gain root privileges, the attacker copied /bin/sh to /usr/bin/dbus-authd, changed the file’s ownership to root and set the SUID (set‑user‑ID) bit, according to CSO Online. The attacker achieved persistence by adding a passwordless sudo entry to the sudoers template through a startup script that survives reboots and configuration resets, according to CSO Online. The attacker then used the proprietary bt‑secrets CLI tool (a command‑line interface for extracting secrets) to dump the appliance’s credential vault, according to CSO Online.

The attacker deleted over 12 system, web server and application logs to hinder detection efforts, according to CSO Online. Using compromised administrator credentials, the attacker raised Jump Item and Team permissions to Administrator, enabling unrestricted remote sessions to downstream systems.

The attacker deployed BARECLAW, a custom SOCKS5 tunneler, and modified the HAProxy configuration to route traffic through a hidden local listener, according to CSO Online. BeyondTrust serves more than 20,000 customers worldwide, including 75% of Fortune 100 companies.

Shadowserver monitors over 1,400 internet‑facing BeyondTrust Remote Support appliances, without indicating how many have been patched or serve as honeypots, according to BleepingComputer. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog on October 16, 2026, obligating Federal Civilian Executive Branch agencies to apply fixes by October 19, 2026, as reported by The Hacker News. Mandiant and Google Threat Intelligence Group warned that organizations should prepare for potential widespread exploitation after the zero‑day disclosure, according to CSO Online and Infosecurity Magazine. “Organizations should prepare for potential widespread exploitation following this disclosure,” said Google Threat Intelligence Group and Mandiant.

BeyondTrust suspects Armory Castle uses AI to model its target products for exploit development, though it notes this suspicion lacks forensic proof, according to CSO Online. BeyondTrust stated it suspects, without forensic proof, that Armory Castle employs AI to model its target products for exploit development, according to CSO Online. BeyondTrust withheld technical details of CVE-2026-102764 while customers patch to avoid increasing risk during the disclosure period, according to CSO Online, Infosecurity Magazine and SC Media. BeyondTrust’s internal messaging component in Remote Support failed to check the origin of incoming messages, enabling the zero‑day exploitation, as reported by The Hacker News.

Defenders should apply the BT26-05‑RS patch, limit external access to needed services, conduct forensics, isolate suspected appliances and rebuild from a clean image, according to CSO Online. Organizations should rotate credentials only after patching to stop new secrets from being written to a still‑controlled appliance. Organizations can also deploy compensating controls such as web application firewalls, credential rotation, session reviews and external vault storage for administrative credentials.

Armory Castle has been active since at least October 2023 and earlier exploited zero‑day flaws in Ivanti Connect Secure and Citrix NetScaler appliances, according to CSO Online. Armory Castle earlier exploited zero‑day vulnerabilities in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282) since at least October 2023. Volexity reported in Jan. 2024 that Armory Castle (then tracked as UNC5221) backdoored over 2,100 Ivanti appliances using the GiftedVisitor webshell in attacks chaining CVE-2023-46805 and CVE-2024-21887.

Armory Castle targeted legal services, SaaS providers, business‑process outsourcers, technology companies and government sectors in past campaigns. Armory Castle’s activity aligns with its historical pattern of selective zero‑day exploitation followed by broad, opportunistic exploitation after public disclosure.

BeyondTrust suspects Armory Castle uses AI to model its target products for exploit development, though it notes this suspicion lacks forensic proof. BeyondTrust stated it suspects, without forensic proof, that Armory Castle employs AI to model its target products for exploit development. BeyondTrust withheld technical details of CVE-2026-102764 while customers patch to avoid increasing risk during the disclosure period. BeyondTrust’s internal messaging component in Remote Support failed to validate the origin of incoming messages, enabling the zero‑day exploitation.

BeyondTrust’s CVE-2026-102764 is its third critical‑rated Remote Support advisory of 2026, following CVE-2026-1731, which was actively exploited shortly after its February 2026 disclosure, according to CSO Online. CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities catalog after its disclosure in February 2026.

The Chinese state‑backed Silk Typhoon hacking group exploited two zero‑days (CVE-2024-12356 and CVE-2024-12686) in BeyondTrust systems in 2024, using a stolen API key to compromise 17 Remote Support SaaS instances, including the U.S. Treasury Department’s instance. Silk Typhoon also targeted the Office of Foreign Assets Control (OFAC) and the Committee on Foreign Investment in the United States (CFIUS) in its 2024 BeyondTrust campaign.

Armory Castle’s post‑exploitation activity included using the BeyondTrust Remote Support file transfer service to download and exfiltrate sensitive internal documents such as software inventories from victims’ desktops. Armory Castle’s post‑exploitation activity included performing internal network reconnaissance and downloading sensitive internal documents from victims’ desktops. Armory Castle escalated from a standard web service account to root‑level control of the appliance host, granting access to every credential stored or brokered by the appliance.

Armory Castle used the BARECLAW tool to tunnel traffic through the BeyondTrust device via a hidden local listener, modifying the HAProxy configuration to ensure accessibility. Armory Castle’s post‑exploitation actions included modifying the BeyondTrust configuration templates to gain passwordless root privileges to the site service account.

BeyondTrust’s Privileged Remote Access (PRA) shares the affected code with Remote Support but lacks a confirmed exploitation method, prompting BeyondTrust to release a patch for PRA as a precaution. BeyondTrust’s AI agent uncovered a 9.9 CVSS‑rated pre‑authentication flaw in Remote Support and Privileged Remote Access earlier in 2026, with around 11,000 exposed instances detected.

Armory Castle’s activity began roughly seven weeks before the October 2026 disclosure, with the first known attack occurring on August 29, 2026. “Organizations should prepare for potential widespread exploitation following this disclosure,”