China-linked Armory Castle hijacks BeyondTrust Remote Support Servers via zero-day since August

The China-linked espionage group Armory Castle—also called UNC5221 or Warp Panda—exploited a zero-day flaw in BeyondTrust Remote Support (CVE-2026-102764, CVSS 9.3) on August 29, 2026, to hijack remote support servers and establish persistent access to downstream systems. BeyondTrust confirmed the vulnerability stems from improper origin validation in an internal messaging component, enabling remote attackers to perform file operations on affected appliances. The flaw affects versions 24.3.1 through 26.2.3, with SaaS customers patched on October 9, while self-hosted environments require manual application of the BT26-05-RS patch or an upgrade to a supported version.

Armory Castle’s intrusion followed a multi-stage playbook designed to evade detection and maintain long-term access. After gaining initial footholds, the group deployed a lightweight PHP web shell named SAWFLY to establish encrypted command-and-control (C2) communication. According to S1-S5, Armory Castle escalated privileges by copying `/bin/sh` to `/usr/bin/dbus-authd`, setting SUID permissions, and modifying ownership to root, creating a persistent backdoor surviving reboots. BeyondTrust detected the intrusion on September 28, 2026, after another vendor’s compromised edge appliances were publicly disclosed, prompting an investigation into similar activity. The company’s third-party detection platform initially misclassified intrusion alerts as false positives, delaying response by 27 minutes before containing the hosted instance.

Once established, Armory Castle leveraged its elevated privileges to harvest credentials using BeyondTrust’s proprietary `/ns/sbin/bt-secrets` CLI utility, granting access to stored passwords, API keys, and endpoint credentials. The group then abused administrative access to launch remote sessions on downstream systems via the appliance’s Jump Item list, exfiltrating sensitive documents for network reconnaissance. To further obscure its activity, Armory Castle deployed BARECLAW, a custom SOCKS5 proxy tunneler, to relay traffic through the compromised BeyondTrust device while deleting system, web server, and application logs. Researchers also noted modifications to `/ns/config/haproxy.conf` to enable direct internet access to BARECLAW, complicating forensic analysis.

Supply Chain Risks and Historical Patterns

Armory Castle’s targeting of BeyondTrust Remote Support aligns with its historical focus on zero-day exploitation in edge appliances, including Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282), which the group has exploited since at least October 2023. The campaign’s victims span sectors including legal services, SaaS providers, governments, and technology firms—high-value targets for espionage. BeyondTrust’s Privileged Remote Access (PRA) product shares affected code with Remote Support but was not exploited in this campaign; patches were applied to both products as a precaution. Shadowserver’s tracking of over 1,400 exposed BeyondTrust Remote Support instances online underscores the scale of potential risk, though the organization does not specify how many remain unsecured or are honeypots.

Google Threat Intelligence Group (GTIG) and Mandiant assess with high confidence that Armory Castle will continue exploiting zero-days in edge devices for espionage. BeyondTrust withheld technical details of CVE-2026-102764 to reduce risk while customers patched, but Google and Mandiant warned of potential widespread exploitation after disclosure. The company’s previous critical flaw, CVE-2026-1731, was also actively exploited shortly after disclosure and added to CISA’s Known Exploited Vulnerabilities catalog.

Mitigation and Industry Response

BeyondTrust’s third-party detection platform initially misclassified intrusion alerts as false positives, delaying response; the company contained the hosted instance within 27 minutes of detection (S1-S2). BeyondTrust delayed public technical details of CVE-2026-102764 to reduce risk while customers patch (S1-S2,S4). Google Threat Intelligence Group and Mandiant assess with high confidence that Armory Castle will continue exploiting zero-days in edge devices for espionage, following a pattern of selective zero-day use followed by broad exploitation after disclosure (S1-S5). BeyondTrust advises SaaS customers to have been patched on October 9, 2026, and self-hosted customers running versions 24.3.1 through 26.2.3 to manually apply the BT26-05-RS patch; older versions require an upgrade first (S1-S5).