ARMORY CASTLE Exploits BeyondTrust Remote Support as Zero-Day
Mandiant reports that the suspected PRC-nexus threat actor ARMORY CASTLE exploited a zero-day vulnerability in BeyondTrust Remote Support appliances in late August 2026, establishing stealthy persistence.
Mandiant has identified evidence that the threat actor ARMORY CASTLE, previously tracked as UNC5221 and associated with the PRC, exploited a zero-day vulnerability in BeyondTrust Remote Support appliances. The exploitation occurred in late August 2026, prior to BeyondTrust's public disclosure of CVE-2026-102764 on October 15th. This vulnerability allows for arbitrary file uploads, and ARMORY CASTLE leveraged it to gain initial access and establish a persistent foothold.
BeyondTrust Remote Support is a critical enterprise solution for secure remote access, enabling IT teams to troubleshoot endpoints. The successful exploitation of CVE-2026-102764 allows attackers to upload malicious files to the appliance. Mandiant observed the exploitation within various log files, including access, syslog, and messages, accessible via a LUKS-encrypted partition. Affected organizations are urged to apply BeyondTrust's security patches immediately.
Following the initial exploitation, ARMORY CASTLE employed a sophisticated set of tactics, techniques, and procedures (TTPs) to escalate privileges and achieve lateral movement. The actor demonstrated a deep understanding of the BeyondTrust appliance's internal workings, utilizing proprietary command-line interface (CLI) utilities, startup configuration templates, and local reverse-proxy routing. This allowed them to operate with significant stealth and effectiveness.
Mandiant identified custom malware used by ARMORY CASTLE, including the SAWFLY webshell and the BARECLAW tunneler. The SAWFLY webshell, a PHP-based backdoor, was staged at the web root and communicated via encrypted C2 channels using a custom Base32 transport and RC4 stream cipher. It was designed to evade automated scanners by returning a 404 error if a specific obfuscated parameter was not present.
To escalate privileges from the unprivileged service account to root, ARMORY CASTLE copied the system shell executable (/bin/sh) to a new file named /usr/bin/dbus-authd. They then modified this file's ownership to root and enabled Set User ID (SUID) permissions. This technique effectively created a persistent root-level backdoor, allowing the actor to execute commands with the highest level of privilege on the appliance.
With root access, ARMORY CASTLE proceeded to harvest credentials directly from the appliance's native secrets management database. They used the proprietary /ns/sbin/bt-secrets CLI utility to dump the appliance's credential vault, attempting both site-specific and global credential extraction. To cover their tracks, the actor also deleted logs related to the bt-secrets binary.
Mandiant warns that organizations should anticipate widespread exploitation following this disclosure. ARMORY CASTLE and other threat actors have a history of broadly exploiting vulnerabilities once they become public. The combination of a zero-day exploit, sophisticated post-exploitation techniques, custom malware, and credential harvesting makes this a significant threat to organizations relying on BeyondTrust Remote Support for secure remote access.