Google Warns Armory Castle Exploited Critical BeyondTrust Flaw for Root Access
Google states the China-linked group Armory Castle abused CVE-2026-102764 in August to gain persistent root access on BeyondTrust appliances.
Key points
- Armory Castle exploited CVE-2026-102764 in August 2026 to establish persistent root-level access on BeyondTrust Remote Support appliances.
- BeyondTrust released a patch on October 8 for SaaS and self-hosted customers but withheld technical details to prevent further exploitation.
- Google warns that widespread exploitation is likely as threat actors historically act opportunistically once vulnerabilities become public knowledge.
Google warned on October 15 that the suspected China state-sponsored espionage group Armory Castle has actively exploited a critical vulnerability in BeyondTrust Remote Support. The threat actor used the flaw, identified as CVE-2026-102764, to escalate privileges and maintain persistent access to compromised appliances during August 2026.
The vulnerability carries a CVSS score of 9.3, indicating severe risk. BeyondTrust publicly disclosed the issue on October 15, following the release of a patch on October 8. The vendor provided updates for both software-as-a-service and self-hosted customers but deliberately withheld specific technical details about the flaw.
Context and Background
BeyondTrust stated that withholding technical specifics was necessary to protect customers who have not yet applied the security update. Google urged affected organizations to patch their systems immediately, noting that Armory Castle and other groups typically conduct broad, opportunistic exploitation once a vulnerability is made public.
As Threat Times reported on October 16, Mandiant previously identified Armory Castle abusing a different critical flaw in BeyondTrust Remote Support to gain root privileges and deploy backdoors in late August. This pattern highlights the group’s consistent focus on compromising remote management infrastructure.
Armory Castle has been active since October 2023, conducting long-term intelligence collection for the People’s Republic of China. The group targets legal services, SaaS providers, business-process outsourcers, technology companies, and government entities. Google assessed with high confidence that the actor will continue leveraging zero-day vulnerabilities in edge devices to support its espionage objectives.
Who Is Affected
Following the exploitation of CVE-2026-102764, Armory Castle deployed tactics tailored specifically for BeyondTrust systems to establish persistence and enable lateral movement. A key component of this activity was the deployment of Sawfly, an obfuscated, lightweight PHP webshell. This tool implements bidirectional encrypted command and control communication, allowing the attackers to maintain covert access to the compromised environment.
To escalate privileges, the attackers copied the system shell executable to the file path /usr/bin/dbus-authd. They then modified the file’s ownership to root and enabled Set User ID permissions. This action effectively created a persistent root-level backdoor on the host system, granting the threat actor complete control over the appliance.
What should you do?
Organizations using BeyondTrust Remote Support should verify that their appliances have received the October 8 patch. Administrators should monitor for unauthorized PHP files or unexpected changes to system executables, particularly in the /usr/bin directory. Any instance of a webshell like Sawfly requires immediate incident response and forensic analysis to determine the scope of the compromise.
What to do and how to stay safe: BeyondTrust
- Verify that all BeyondTrust Remote Support appliances, both SaaS and self-hosted, have been updated with the patch released on October 8.
- Monitor system logs for unusual privilege escalation attempts or the creation of new executables in sensitive directories like /usr/bin.
- Scan for the presence of the Sawfly PHP webshell or other unauthorized scripts that facilitate encrypted command and control communications.
- Review file permissions on critical system binaries to ensure that Set User ID bits have not been improperly enabled by unauthorized actors.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for the BeyondTrust vulnerability exploited by Armory Castle?
The vulnerability is identified as CVE-2026-102764, which has a CVSS rating of 9.3 and was publicly disclosed by BeyondTrust on October 15.
When was the patch for CVE-2026-102764 released?
BeyondTrust released the patch on October 8 for both software-as-a-service and self-hosted customers, although technical details were withheld until October 15.
How did Armory Castle maintain persistence after exploiting the flaw?
The group deployed a PHP webshell called Sawfly and created a root-level backdoor by modifying the /usr/bin/dbus-authd file with Set User ID permissions.
