CVE-2026-102764: ARMORY CASTLE Exploits BeyondTrust Zero-Day

ARMORY CASTLE Exploits BeyondTrust Remote Support Zero-Day

Mandiant has identified active exploitation of a zero-day vulnerability, CVE-2026-102764, in BeyondTrust Remote Support (formerly Bomgar) appliances. The threat actor, identified as ARMORY CASTLE (formerly tracked as UNC5221 and suspected to be a PRC-nexus espionage group), leveraged this flaw in late August 2026. The vulnerability allows for the arbitrary upload of files, which ARMORY CASTLE exploited to establish persistent access and escalate privileges on compromised appliances, as detailed in an advisory from Google Cloud’s Mandiant. Organizations utilizing BeyondTrust Remote Support are urged to apply available security patches immediately, as there is a high likelihood of widespread exploitation following public disclosure.

Technical Details of CVE-2026-102764 Exploitation

The initial compromise involves the successful exploitation of CVE-2026-102764 to upload arbitrary files. Mandiant’s investigation uncovered evidence of this exploitation in various log files (access, syslog, messages, thin-scc, brain, and SSL logs), which reside on a LUKS-encrypted partition containing the /home directory. This initial access serves as the beachhead for subsequent malicious activities.

Following the arbitrary file upload, ARMORY CASTLE exhibited a deep understanding of BeyondTrust appliance internals, employing a range of sophisticated tactics, techniques, and procedures (TTPs) to establish a persistent foothold, escalate privileges, and enable lateral movement.

SAWFLY Webshell and Persistence

After successful exploitation, ARMORY CASTLE initiated POST requests to /app_84304470%2Ephp, subsequently creating the SAWFLY webshell at the web root path /%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/. This webshell, named mangoapi.php, is an obfuscated, lightweight PHP script designed for encrypted command-and-control (C2) communication. SAWFLY utilizes a custom Base32 transport layer and a 256-bit RC4 stream cipher for bidirectional encrypted traffic. To evade automated detection, it checks for an obfuscated parameter _c94mfe in incoming HTTP POST requests, returning a 404 Not Found status if absent. When present, the webshell decodes, decrypts, and executes the payload via @eval(), returning encrypted and encoded output. Detecting SAWFLY webshell persistence is critical for identifying ongoing compromises.

Privilege Escalation and Credential Harvesting

Initially, the SAWFLY webshell ran under an unprivileged site service account. To gain root-level control, ARMORY CASTLE copied the system shell executable (/bin/sh) to /usr/bin/dbus-authd. They then modified its ownership to root and enabled Set User ID (SUID) permissions. This manipulation allowed the binary to execute with root privileges regardless of the calling user, effectively creating a persistent root-level backdoor. This elevation granted the threat actor full access to every credential stored or brokered by the appliance and the ability to modify critical files.

Mandiant also observed ARMORY CASTLE attempting to harvest credentials directly from the appliance’s native secrets management database. The actor leveraged the proprietary administrative CLI utility /ns/sbin/bt-secrets to dump the appliance’s credential vault. They systematically iterated through commands such as:

• /ns/sbin/bt-secrets get -p %SITE_SERVICE_ACCOUNT% vault
• /ns/sbin/bt-secrets get %SITE_SERVICE_ACCOUNT% vault
• /ns/sbin/bt-secrets get vault

These commands allowed them to target specific site service account vaults and then fallback to the global, appliance-level password safe to dump all stored administrative credentials. To cover their tracks, the threat actor forcibly removed log records associated with bt-secrets activity, specifically /home/bomgar/log/bt-secrets.log and its archived files.

Actionable Recommendations for BeyondTrust Remote Support Appliance Security

To effectively remediate and prevent further compromise, organizations must prioritize the following:

• Immediate Patching: Apply all security patches provided by BeyondTrust for CVE-2026-102764 without delay. This is the single most critical step in mitigating ARMORY CASTLE BeyondTrust exploits.
• Incident Response & Forensics: Conduct a thorough incident response investigation to identify any signs of compromise. Pay close attention to logs accessible via the LUKS-encrypted partition (access, syslog, messages, thin-scc, brain, SSL logs) for indicators of arbitrary file uploads, webshell creation, or suspicious command execution.
• Indicator of Compromise (IOC) Hunting: Actively scan for the presence of the SAWFLY webshell (mangoapi.php or similar suspicious PHP files in web root paths) and look for unauthorized changes to SUID permissions, particularly for files like /usr/bin/dbus-authd.
• Credential Review: Assume any credentials stored on or brokered by the compromised BeyondTrust appliance may have been exfiltrated. Initiate a comprehensive review and rotation of all associated passwords and API keys.
• Log Monitoring: Enhance monitoring of BeyondTrust appliance logs for any suspicious activity, especially attempts to access or clear logs related to bt-secrets or unusual file modifications in sensitive directories.
• Network Segmentation: Ensure BeyondTrust Remote Support appliances are adequately segmented from critical internal networks to limit potential lateral movement in the event of a compromise.

Remaining vigilant and proactively implementing these measures is essential for maintaining strong BeyondTrust Remote Support appliance security against sophisticated threat actors like ARMORY CASTLE.

Related: CrowdStrike Falcon Zero-Day ‘FalconFlank’ Grants SYSTEM Privileges, ShieldBreak: Windows Zero-Day EoP via Microsoft Defender