The China-linked espionage group Armory Castle exploited a security vulnerability in BeyondTrust Remote Support appliances starting on August 29, 2026, before a patch was available, as part of a long-term espionage campaign. The vulnerability, tracked as CVE-2026-102764, received a score of 9.3 under the CVSS system and, due to improper validation of message origin, allows file operations to be executed on Remote Support appliances.
BeyondTrust identified the flaw on September 28, one day after public information emerged about its exploitation against a security appliance provider. The company said it had prepared the patch by September 30, but delayed its release to test it and address additional exploitation paths before releasing it on October 8 as part of the BT26-05-RS update.
Affected Scope and Patching Actions
All Remote Support versions through version 26.2.3 are affected, while the patch covered versions 24.3.1 through 26.2.3. Customers using a version older than 24.3.1 must upgrade to a newer version and then install the patch. BeyondTrust confirmed that the update had been applied to all Remote Support SaaS customers by October 9, 2026, while users of self-hosted environments must install it manually if automatic updates are not enabled.
How Was the Breach Carried Out?
According to Mandiant and the Google Threat Intelligence Group, Armory Castle, also known as UNC5221 and Warp Panda, used the vulnerability for initial access to a BeyondTrust appliance hosted by the company and another that was self-hosted. The group then deployed Sawfly, a PHP webshell backdoor that provides encrypted two-way communication with the command-and-control server, along with Bareclaw, which operates as a SOCKS5 tunnel.
The group gained root-level control of the appliance host, collected credentials, and obtained passwordless root privileges for a site service account, then deleted system, web server, and application logs to conceal its traces. It also used compromised administrative credentials to modify account permissions and control remote systems before targeting internal endpoints.
The attackers also exploited the appliance’s built-in support tools to gain access to the entire file system and used BeyondTrust’s native file-transfer service to download and exfiltrate sensitive internal documents from user devices, including lists of installed software that assist with network reconnaissance.
Why Does This Matter?
The incident is significant because a Remote Support appliance is not merely an external access point; it can provide an attacker with a path to administrative accounts, internal systems, and user files. The sequence also shows that patching alone does not necessarily address the effects of a prior compromise, particularly after the use of a webshell, credential theft, and log deletion. Affected organizations need to apply the update according to the appropriate release path and review self-hosted appliances, treating any appliance exploited before October 8 as requiring forensic investigation and restoration of trust—an information-security implication based on the intrusion methods observed by researchers.
Armory Castle is known for targeting SaaS providers, technology companies, government entities, legal services, and business-services contractors. It has previously been observed exploiting zero-day vulnerabilities in Citrix NetScaler, Ivanti Connect Secure, and Dell RecoverPoint for Virtual Machines, placing edge and remote-management appliances within the group’s continuing area of interest.