Google Warns Chinese Espionage Group Exploited BeyondTrust Zero-Day for Root Access
Mandiant found ARMORY CASTLE abused a critical flaw in BeyondTrust Remote Support to gain root privileges and deploy backdoors in late August.
Key points
- A China-linked group exploited CVE-2026-102764 in BeyondTrust Remote Support appliances before the vendor disclosed the flaw on October 15.
- Attackers deployed the SAWFLY webshell and used SUID bit manipulation to escalate from an unprivileged service account to root access.
- The group, tracked as ARMORY CASTLE, targeted credential storage utilities and altered appliance permissions to maintain persistent control.
Google Cloud Researchers warned that a suspected China-linked espionage group exploited a critical zero-day vulnerability in BeyondTrust Remote Support appliances. The intrusion occurred in late August 2026, weeks before BeyondTrust publicly disclosed the security flaw on October 15, as Threat Times reported earlier this month.
Mandiant, which investigated the incident, attributed the activity to ARMORY CASTLE, a group previously tracked as UNC5221. The attackers used the unauthenticated flaw to upload files and establish initial access. They then executed a complex privilege escalation sequence to gain root control over the internet-facing appliances.
Technical details of the intrusion
The attackers sent POST requests to a specific PHP endpoint to stage their entry. Approximately eleven minutes later, logs showed the creation of a PHP webshell named SAWFLY in the web-root directory. Mandiant could not recover the initial file associated with the staging requests, so its specific name remains unconfirmed.
SAWFLY is a lightweight, obfuscated implant that uses custom Base32 transport and RC4 encryption. It returns a 404 response when its expected parameter is absent, which helps it evade routine security scanners. When the correct parameter is present, the webshell decrypts and executes supplied PHP code, allowing remote command execution.
To move from the unprivileged site service account to root, the attackers copied /bin/sh to /usr/bin/dbus-authd. They changed the file owner to root and enabled the Set User ID bit. This configuration allowed the executable to run with root privileges, providing a direct path to full appliance control.
Credential theft and persistence
After securing root access, the group targeted BeyondTrust’s native secrets-management utility, bt-secrets. They attempted multiple command forms to retrieve credentials from both site-specific vaults and the appliance-wide password safe. The attackers subsequently deleted the utility’s log and archived records to cover their tracks.
The group also deployed the BARECLAW tunneler to create a route for moving deeper into victim networks. Their post-exploitation activity demonstrates detailed knowledge of BeyondTrust internal components, including command-line utilities and reverse-proxy routing configurations. This expertise helped them convert initial access into durable, long-term control.
What should you do?
Organizations using BeyondTrust Remote Support appliances should verify they have applied the patches published in the vendor’s security advisory. Administrators should review appliance logs for suspicious POST requests to PHP endpoints and check for unauthorized modifications to system binaries.
Security teams should monitor for the presence of the SAWFLY webshell or similar obfuscated PHP implants in web-root directories. It is also critical to audit permissions on sensitive utilities like bt-secrets and ensure that no unexpected SUID bits have been enabled on system files.
What to do and how to stay safe: BeyondTrust
- Apply the latest vendor patches for BeyondTrust Remote Support immediately to close the authentication bypass.
- Audit system binaries for unexpected SUID permissions or copies of shell executables in unusual directories.
- Monitor web access logs for anomalous POST requests to PHP files that return 404 errors for standard scans.
- Rotate credentials stored in appliance vaults and verify the integrity of secrets-management utilities.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102764?
It is a critical vulnerability in BeyondTrust Remote Support appliances that allows unauthenticated remote attackers to perform file operations and upload malicious content.
Who is ARMORY CASTLE?
ARMORY CASTLE is a suspected China-nexus espionage group, previously tracked as UNC5221, responsible for exploiting this zero-day to gain root access.
How did attackers escalate privileges?
They copied a shell binary to a new location, set the owner to root, and enabled the SUID bit to run commands with root-level privileges.
