Armory Castle Exploits BeyondTrust Zero-Day Flaw in Remote Support Software
A Chinese cyber espionage group abused a high-severity vulnerability in BeyondTrust software to deploy web shells and tunneling tools in late August 2026.
Key points
- Armory Castle exploited CVE-2026-102764, a CVSS 9.3 zero-day, in BeyondTrust Remote Support.
- The flaw allows improper origin validation in an internal messaging component for file operations.
- Threat actors deployed the SAWFLY web shell and BARECLAW tunneling program on affected appliances.
The China-nexus cyber espionage group known as Armory Castle exploited a zero-day vulnerability in BeyondTrust Remote Support software during late August 2026. Mandiant, a Google-owned cybersecurity firm, disclosed that the group used this flaw to deploy malicious tools on affected appliances. This incident highlights the continued threat posed by nation-state actors targeting remote management platforms.
The vulnerability, identified as CVE-2026-102764, carries a CVSS score of 9.3, which is rated as critical. According to Mandiant, the flaw stems from improper origin validation within an internal messaging component of the BeyondTrust appliance. A remote attacker could exploit this defect to perform file operations on the affected device. The group previously tracked as UNC5221 or Warp Panda demonstrated sophisticated capabilities in this attack.
Attack Methodology and Tools
Mandiant reported that the threat actors deployed a lightweight PHP web shell named SAWFLY to establish interactive remote access. They also installed a tunneling program called BARECLAW to route traffic through the compromised BeyondTrust device. These tools allowed the group to maintain control and route traffic via the appliance. The use of custom tools suggests a tailored approach to the attack.
Scope and Impact Assessment
Only a small number of organizations are assessed to be impacted by this specific exploitation campaign. Mandiant’s analysis indicates that the attack was targeted rather than widespread. The group focused on specific entities. The limited scope does not diminish the severity of the vulnerability, as the zero-day status indicates the flaw was exploited before public disclosure.
What should you do?
Security teams should verify if their BeyondTrust Remote Support appliances are vulnerable to CVE-2026-102764. Monitor network traffic for unusual connections that might indicate the use of the BARECLAW tunneling tool. Look for unauthorized PHP files or web shells on remote management servers. Review access logs for signs of the SAWFLY web shell or other anomalous activities.
What to do and how to stay safe: BeyondTrust
- Check BeyondTrust Remote Support appliances for indicators of compromise related to CVE-2026-102764.
- Monitor network logs for traffic patterns consistent with the BARECLAW tunneling program.
- Scan remote management servers for unauthorized PHP files or the SAWFLY web shell.
- Restrict external access to remote support appliances until a patch is confirmed available.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the BeyondTrust vulnerability?
The vulnerability, CVE-2026-102764, has a CVSS score of 9.3.
Which threat actor exploited this zero-day flaw?
The China-nexus cyber espionage group known as Armory Castle exploited the flaw.
How many organizations were affected by this attack?
Mandiant assessed that only a small number of organizations were impacted.
