China-linked group exploits BeyondTrust zero-day to steal credentials

A China-linked espionage group known as ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances starting in August 2026 to steal credentials and access internal networks ^[1][3].

The vulnerability, tracked as CVE-2026-102764, allows unauthenticated remote attackers to perform file operations and arbitrary uploads on affected devices ^[1][2]. BeyondTrust explained that internal components of the software did not adequately validate the origin of received messages, which allowed attackers to perform file operations under specific conditions ^[2]. Because these appliances—previously known as Bomgar—are used by IT teams to troubleshoot remote systems, a compromise can expose stored secrets and provide a direct route into other internal machines ^[1].

ARMORY CASTLE exploits BeyondTrust zero-day

BeyondTrust confirmed that the flaw affects supported Remote Support versions up to 26.2.3 ^[1][2]. The company also released a precautionary patch for its Privileged Remote Access (PRA) product because it shares the same affected code, though BeyondTrust stated it has no evidence that hackers attacked that specific product ^[2].

Google's Mandiant unit attributed the activity to ARMORY CASTLE, also known as Warp Panda or UNC5221 ^[1][2]. According to Mandiant, the group specializes in attacking edge appliances to gain long-term access before pivoting deeper into a victim's IT environment ^[2]. Mandiant warned that the actor typically uses zero-days selectively against chosen targets before moving to broad exploitation of all unpatched instances once a vulnerability becomes public ^[2].

Establishing persistent root access

After exploiting the flaw, attackers deployed a PHP-based webshell known as SAWFLY, which appeared in the web directory as "mangoapi.php" ^[1][3]. Investigators noted that the webshell was staged roughly 11 minutes after initial suspicious POST requests were sent to /app_84304470%2Ephp ^[1][3]. The webshell used Base32 encoding and RC4 encryption to execute code and returned 404 errors when a specific parameter, "_c94mfe", was missing to evade security scanners ^[3][8].

To maintain control, the actors created a shell at /usr/bin/dbus-authd and enabled SUID (set-user-ID) permissions—a permission that allows a user to execute a file with the permissions of the file's owner—to secure root-level access ^[1][3]. They also deployed a startup script called "zz-root-persist" in a post-boot directory and modified the sudoers template (/ns/config/sudoers.template) to ensure passwordless administrative privileges survived reboots or configuration resets ^[3].

Privilege escalation and data exfiltration

Once root access was established, the attackers used the appliance's native "bt-secrets" utility in multiple command variations to attempt to dump the credential vault ^[1][8]. This utility can expose passwords, API keys, and other stored secrets ^[1]. BeyondTrust reported that the attackers also engaged in anti-forensic behavior, deleting bt-secrets log records and other system, web server, and application logs during the intrusion ^[1].

Using compromised administrator credentials, the attackers pivoted into the administrative portal and raised permissions for Jump Items and teams from "No Access" to "Administrator" ^[1][8]. This authority allowed them to launch remote sessions to downstream systems, where they used built-in file transfer features to steal internal documents and software inventories from endpoint desktops for reconnaissance purposes ^[1][3].

Network pivoting via the BARECLAW tunnel

To preserve an external access path, the actors deployed BARECLAW, a custom C-based SOCKS5 tunneling tool that operates over WebSocket connections ^[1][3]. In observed deployments, the tool used port 19800 and the /uidchanarge endpoint with token authentication and XOR-based traffic obfuscation, though TLS was not enabled ^[3].

The attackers modified the appliance's HAProxy configuration—the load balancer used to manage traffic—to route specific internet requests to the local BARECLAW service ^[1][8]. This method allowed the tunnel to blend into the appliance's existing web traffic, hiding the access channel from external scans ^[1].

BeyondTrust patched its SaaS customer instances on either Oct. 8 ^[2] or Oct. 9 ^[3] and disclosed the vulnerability on Oct. 15 ^[3][4]. The company noted that while its sensors detected privilege escalation in real time, a third-party automated triage system incorrectly closed high-severity alerts as false positives, which delayed detection until independent threat hunting uncovered the intrusion ^[8].

Mandiant stated that any vulnerable appliance reachable from the internet during the exploitation window should be treated as potentially compromised until reviewed ^[1].

What we don't know

• Whether the attempts to dump the credential vault using the bt-secrets utility were fully successful.
• Which specific organizations or sectors were the primary targets during the selective zero-day phase.
• The total number of self-hosted appliances that have been confirmed as compromised.