Armory Castle exploits zero-day in BeyondTrust Remote Support: analysis of CVE-2026-102764

The critical vulnerability CVE-2026-102764 (CVSSv4 9.3) in BeyondTrust Remote Support was exploited as a zero-day by the Armory Castle group (formerly UNC5221), which is presumably linked to the PRC. According to Mandiant (GTIG), exploitation began on 29 August 2026 on a single self-hosted device. The vulnerability allows a remote attacker to perform file operations on the device due to insufficient validation of the source of messages in internal components. All Remote Support versions up to and including 26.2.3 are affected. Patch BT26-05-RS for SaaS customers was applied by the vendor on 9 October 2026; self-hosted installations require manual updating.

Technical characteristics of the vulnerability

According to the BeyondTrust advisory, the vulnerability is related to incorrect validation of the source of messages in an internal Remote Support messaging component. Under certain conditions this allows a remote attacker to perform file operations on the device — a critical vector that opens the way to full compromise.

Affected versions and update procedure:

• SaaS customers — the patch was applied automatically by BeyondTrust by 9 October 2026.
• Self-hosted versions 24.3.1–26.2.3 — patch BT26-05-RS must be installed manually.
• Versions earlier than 24.3.1 — you must first upgrade to a supported version and then apply the patch.

It is important to note: updating alone does not eliminate the consequences of a possible compromise that occurred before the patch was installed. Any device that was accessible from the internet on a vulnerable version during the exploitation period should be treated as potentially compromised and investigated — this is a recommendation that Mandiant states explicitly.

Threat actor profile and attack path

Attribution of the attack to the Armory Castle group comes from GTIG/Mandiant and is an intelligence assessment rather than an independently confirmed fact. According to Mandiant, Armory Castle is a cyber espionage threat actor presumably linked to the PRC, previously tracked as UNC5221. The group is known for exploiting zero-day vulnerabilities in network devices: CVE-2023-4966 in Citrix NetScaler, CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure, as well as CVE-2025-0282 — all of these CVEs are included in the CISA KEV catalog. Previously we have already covered the exploitation of Citrix NetScaler vulnerabilities in the context of active attacks.

According to BeyondTrust’s description, the actor operates in a characteristic pattern: selectively using zero-days against preselected high-value targets, and after public disclosure of the vulnerability switching to mass exploitation of unpatched instances. The vendor also notes that, in its working assessment, the actor preselects target software products and maintains working models of these products for developing exploit chains.

Post-exploitation actions

Mandiant describes a multi-stage post-exploitation process that demonstrates deep knowledge of the internal architecture of BeyondTrust devices:

• Initial access and persistence: deployment of the SAWFLY PHP web shell for interactive remote access with an encrypted bidirectional C2 channel. To disguise traffic, commercial VPN nodes and compromised home routers were used.
• Privilege escalation: copying the system shell (/bin/sh) to /usr/bin/dbus-authd with owner set to root and the SUID bit enabled — a classic technique for obtaining persistent root access that survives reboots.
• Credential theft: attempts to extract secrets from the device’s built-in secrets management database via the proprietary CLI utility /ns/sbin/bt-secrets, intended for storing passwords, API keys, and endpoint credentials. Mandiant records attempts at extraction but does not state that each of them was successful.
• Lateral movement: obtaining administrative access to the Remote Support application, reconnaissance via compromised administrator accounts, initiating remote sessions to downstream systems from the device’s Jump Items list with full access to the file systems of target hosts.
• Tunneling: use of BARECLAW — a custom SOCKS5 proxy tunneler written in C that relays TCP connections. The reverse proxy configuration (/ns/config/haproxy.conf) was modified to provide direct access to BARECLAW from the internet.
• Anti-detection measures: systematic deletion of system, web server, and application logs.

Indicators of compromise

Published file indicators:

• SAWFLY (web shell): file mangoapi.php, SHA-256: dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb
• BARECLAW (SOCKS5 tunneler): file ingredi_ws, SHA-256: 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462
• Intermediate path: /app_84304470%2Ephp (hash not published)

Scale and impact assessment

The available data confirm active zero-day exploitation but do not allow the scale of the campaign to be assessed: Mandiant describes the results of an investigation into a specific incident, and BeyondTrust reports investigating a single affected instance. The total number of compromised organizations has not been established.

Nevertheless, the risk is significant. BeyondTrust Remote Support is a product for remote technical support that is widely used in corporate environments. Compromise of such a device gives the attacker not just an entry point but a ready-made mechanism for accessing numerous downstream systems via legitimate remote management functions. The target sectors of Armory Castle, according to the original report, include legal services, SaaS providers, outsourcing companies, the technology sector, and government organizations.

Recommendations for defense and detection

The key difficulty in detecting this attack is the systematic deletion of logs on the device itself. Therefore, defenders should rely on external telemetry rather than on local device logs:

• Immediately update all self-hosted Remote Support instances to a version with patch BT26-05-RS. Versions earlier than 24.3.1 require a preliminary upgrade.
• Perform retrospective analysis of all devices that were accessible from the internet on a vulnerable version from late August 2026 onward.
• Prioritize external telemetry: forwarded syslog records, WAF and reverse proxy logs, perimeter sensor data, and Remote Support session reports.
• Look for anomalies: atypical PHP files in application directories, WebSocket upgrades, changes to administrative roles, bulk file transfers via Remote Support sessions.
• Check IOCs: presence of the hashes listed above, non-standard SUID files (especially /usr/bin/dbus-authd), modifications to haproxy.conf.
• Rotate credentials stored on the device, including API keys and passwords from the secrets database, if compromise is confirmed or cannot be ruled out.

Updating the device is a necessary but insufficient step. Organizations operating BeyondTrust Remote Support with internet exposure should proceed from the assumption of possible compromise and carry out a full investigation using external telemetry sources, without limiting themselves to installing the patch. Given the documented practice of Armory Castle switching to mass exploitation after public disclosure of a vulnerability, the window for safe updating narrows with each passing day.