A China-linked cyber espionage group known as Armory Castle, previously tracked as UNC5221 or Warp Panda, exploited a previously unknown flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day, according to BeyondTrust and Google-owned Mandiant.
The vulnerability, CVE-2026-102764, carries a CVSS score of 9.3 and stems from improper origin validation in an internal messaging component. BeyondTrust said the affected components "did not adequately validate the origin of the messages it received," which under certain conditions could allow a remote attacker to perform file operations on an appliance.
Patches reached all Remote Support SaaS customers on October 9, 2026. Self-hosted customers running versions 24.3.1 through 26.2.3 must manually apply the BT26-05-RS patch, while those on older versions must upgrade first.
BeyondTrust's timeline states Armory Castle exploited the flaw against a single self-hosted appliance on August 29, 2026. Public disclosure of successful exploitation of another security device provider on September 27 prompted the company to hunt for similar activity.
Mandiant reported that a successful compromise is followed by deployment of a lightweight PHP web shell called SAWFLY, used for interactive remote access and encrypted command-and-control traffic. The operator routes traffic through commercial VPN exit nodes and compromised home and small-office routers to blend in, then uses the web shell to escalate privileges, gain administrative control and establish persistence across reboots.
Post-exploitation steps included: - Copying /bin/sh to /usr/bin/dbus-authd with root ownership and SUID permissions to gain root-level control. - Harvesting credentials from the appliance's native secrets database using the bt-secrets CLI utility. - Targeting configuration templates to obtain passwordless root access to the site service account. - Using compromised administrator credentials to reconnoiter and launch remote sessions to downstream systems in the Jump Item list. - Tunneling traffic through BARECLAW, a custom SOCKS5 proxy, exposed via a modified haproxy.conf file. - Deleting system, web server and application logs to hinder detection.
BeyondTrust said the actor uses zero-days selectively against chosen targets and shifts to broad exploitation of unpatched instances once a flaw becomes public. It described the actor as selecting high-value software targets in advance and maintaining a working model of targeted products in an AI context to develop exploit chains.
Armory Castle has previously exploited zero-days in Citrix NetScaler and Ivanti Connect Secure appliances across legal services, SaaS providers, business-process outsourcers, technology and governments, and has been active since October 2023. Mandiant researchers noted the group's deep understanding of BeyondTrust appliance internals, citing abuse of proprietary CLI utilities, startup configuration templates and local reverse-proxy routing. They warned that any appliance reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until reviewed.
Source: The Hackers News