# CVE-2026-102764: ARMORY CASTLE Exploits BeyondTrust Zero-Day

> ARMORY CASTLE, a suspected PRC-nexus actor, exploited a zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances for espionage.

- Published: 2026-11-01T03:22:27.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: Zero-Day, Webshell, Privilege Escalation, ARMORY CASTLE, BeyondTrust Remote Support
- CVEs: CVE-2026-102764
- Author: Runtime Rebel Intel
- Primary source: https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/
- Canonical: https://runtimerebel.com/blog/cve-2026-102764-armory-castle-exploits-beyondtrust-zero-day

## Key points

- Suspected PRC-nexus actor ARMORY CASTLE is actively exploiting a zero-day vulnerability in BeyondTrust Remote Support.
- BeyondTrust Remote Support appliances (formerly Bomgar) are critically affected by CVE-2026-102764, enabling arbitrary file upload.
- Immediate application of BeyondTrust security patches is crucial to mitigate ongoing exploitation and prevent persistent access.

## ARMORY CASTLE Exploits BeyondTrust Remote Support [Zero-Day](/glossary#zero-day)

Mandiant has identified active exploitation of a zero-day [vulnerability](/glossary#vulnerability), [CVE-2026-102764](https://nvd.nist.gov/vuln/detail/CVE-2026-102764), in BeyondTrust Remote Support (formerly Bomgar) appliances. The [threat actor](/glossary#threat-actor), identified as [ARMORY CASTLE](https://en.wikipedia.org/wiki/Threat_actor#State-sponsored_groups) (formerly tracked as UNC5221 and suspected to be a PRC-nexus espionage group), leveraged this flaw in late August 2026. The vulnerability allows for the arbitrary upload of files, which ARMORY CASTLE exploited to establish persistent access and escalate privileges on compromised appliances, as detailed in an advisory from [Google Cloud's Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/). Organizations utilizing BeyondTrust Remote Support are urged to apply available security patches immediately, as there is a high likelihood of widespread exploitation following public disclosure.

### Technical Details of [CVE](/glossary#cve)-2026-102764 Exploitation

The initial compromise involves the successful exploitation of [CVE-2026-102764](https://nvd.nist.gov/vuln/detail/CVE-2026-102764) to upload arbitrary files. Mandiant's investigation uncovered evidence of this exploitation in various log files (access, syslog, messages, thin-scc, brain, and SSL logs), which reside on a LUKS-encrypted partition containing the `/home` directory. This [initial access](/glossary#initial-access) serves as the beachhead for subsequent malicious activities.

Following the arbitrary file upload, ARMORY CASTLE exhibited a deep understanding of BeyondTrust appliance internals, employing a range of sophisticated tactics, techniques, and procedures (TTPs) to establish a persistent foothold, escalate privileges, and enable [lateral movement](/glossary#lateral-movement).

#### SAWFLY Webshell and [Persistence](/glossary#persistence)

After successful exploitation, ARMORY CASTLE initiated POST requests to `/app_84304470%2Ephp`, subsequently creating the **SAWFLY webshell** at the web root path `/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/`. This webshell, named `mangoapi.php`, is an obfuscated, lightweight PHP script designed for encrypted command-and-control ([C2](/glossary#c2)) communication. SAWFLY utilizes a custom Base32 transport layer and a 256-bit RC4 stream cipher for bidirectional encrypted traffic. To evade automated detection, it checks for an obfuscated parameter `_c94mfe` in incoming HTTP POST requests, returning a 404 Not Found status if absent. When present, the webshell decodes, decrypts, and executes the [payload](/glossary#payload) via `@eval()`, returning encrypted and encoded output. Detecting SAWFLY webshell persistence is critical for identifying ongoing compromises.

#### [Privilege Escalation](/glossary#privilege-escalation) and [Credential Harvesting](/glossary#credential-harvesting)

Initially, the SAWFLY webshell ran under an unprivileged site service account. To gain root-level control, ARMORY CASTLE copied the system shell executable (`/bin/sh`) to `/usr/bin/dbus-authd`. They then modified its ownership to root and enabled Set User ID (SUID) permissions. This manipulation allowed the binary to execute with root privileges regardless of the calling user, effectively creating a persistent root-level [backdoor](/glossary#backdoor). This elevation granted the threat actor full access to every credential stored or brokered by the appliance and the ability to modify critical files.

Mandiant also observed ARMORY CASTLE attempting to harvest credentials directly from the appliance's native [secrets management](/glossary#secrets-management) database. The actor leveraged the proprietary administrative CLI utility `/ns/sbin/bt-secrets` to dump the appliance's credential vault. They systematically iterated through commands such as:

*   `/ns/sbin/bt-secrets get -p %SITE_SERVICE_ACCOUNT% vault`
*   `/ns/sbin/bt-secrets get %SITE_SERVICE_ACCOUNT% vault`
*   `/ns/sbin/bt-secrets get vault`

These commands allowed them to target specific site service account vaults and then fallback to the global, appliance-level password safe to dump all stored administrative credentials. To cover their tracks, the threat actor forcibly removed log records associated with `bt-secrets` activity, specifically `/home/bomgar/log/bt-secrets.log` and its archived files.

### Actionable Recommendations for BeyondTrust Remote Support Appliance Security

To effectively remediate and prevent further compromise, organizations must prioritize the following:

*   **Immediate Patching:** Apply all security patches provided by BeyondTrust for CVE-2026-102764 without delay. This is the single most critical step in mitigating ARMORY CASTLE BeyondTrust exploits.
*   **Incident Response & Forensics:** Conduct a thorough incident response investigation to identify any signs of compromise. Pay close attention to logs accessible via the LUKS-encrypted partition (access, syslog, messages, thin-scc, brain, SSL logs) for indicators of arbitrary file uploads, webshell creation, or suspicious command execution.
*   **Indicator of Compromise ([IOC](/glossary#ioc)) Hunting:** Actively scan for the presence of the SAWFLY webshell (`mangoapi.php` or similar suspicious PHP files in web root paths) and look for unauthorized changes to SUID permissions, particularly for files like `/usr/bin/dbus-authd`.
*   **Credential Review:** Assume any credentials stored on or brokered by the compromised BeyondTrust appliance may have been exfiltrated. Initiate a comprehensive review and rotation of all associated passwords and [API](/glossary#api) keys.
*   **Log Monitoring:** Enhance monitoring of BeyondTrust appliance logs for any suspicious activity, especially attempts to access or clear logs related to `bt-secrets` or unusual file modifications in sensitive directories.
*   **[Network Segmentation](/glossary#network-segmentation):** Ensure BeyondTrust Remote Support appliances are adequately segmented from critical internal networks to limit potential lateral movement in the event of a compromise.

Remaining vigilant and proactively implementing these measures is essential for maintaining strong BeyondTrust Remote Support appliance security against sophisticated threat actors like ARMORY CASTLE.

**Related:** [CrowdStrike Falcon Zero-Day 'FalconFlank' Grants SYSTEM Privileges](/blog/crowdstrike-falcon-zero-day-falconflank-grants-system-privileges), [ShieldBreak: Windows Zero-Day EoP via Microsoft Defender](/blog/shieldbreak-windows-zero-day-eop-via-microsoft-defender)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-102764-armory-castle-exploits-beyondtrust-zero-day