A suspected Chinese espionage crew broke into BeyondTrust Remote Support appliances through a flaw nobody knew about, weeks before the vendor disclosed it. Google Threat Intelligence Group (GTIG) and Mandiant say the actor they now call ARMORY CASTLE, previously tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August 2026, then used the hijacked appliances to steal credentials and reach the machines those appliances are trusted to manage.
BeyondTrust Remote Support, formerly known as Bomgar, is the tool many IT teams use to jump onto employee and server endpoints for troubleshooting. That trust is exactly what makes it valuable to an intruder. BeyondTrust disclosed the bug on October 15. It affects all supported Remote Support versions up to 26.2.3 and lets an unauthenticated remote attacker perform file operations on the appliance. NVD scores it 9.3.
From a file upload to root on the box
In the original report, written by Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch and John Wolfram, Mandiant describes a methodical intrusion. About 11 minutes after the first exploit request, a new webshell called SAWFLY appeared in the appliance's web root. SAWFLY is a small, obfuscated PHP backdoor that answers with a plain 404 unless a request carries a specific secret parameter, which hides it from crawlers and scanners.
Because the webshell ran as an unprivileged service account, the operators copied the system shell to /usr/bin/dbus-authd, made root its owner and set the SUID bit, giving themselves a reusable root backdoor. They then planted a startup script that adds a passwordless sudo rule to BeyondTrust's own configuration template, so the access survives reboots and configuration resets that would normally wipe manual changes.
The credential vault was the prize
With root, the actor turned to the appliance's built-in secrets utility, bt-secrets, and tried several command variations to dump stored passwords, API keys and endpoint credentials, then deleted the tool's log. Using a compromised administrator account, they upgraded that account's Jump Item and Team permissions from No Access to Administrator, granting standing rights to open remote sessions to downstream systems. Mandiant saw them use the product's own file transfer feature to pull internal documents, such as software inventories, from a user's desktop.
For network access, the crew deployed BARECLAW, a custom tunneler written in C that runs a SOCKS5 proxy over WebSocket, and edited the appliance's HAProxy configuration so that one obscure URL path was routed straight to it. They repeatedly deleted system, web server and application logs along the way.
Expect a wider wave now the bug is public
GTIG warns that this crew has a habit of exploiting a flaw quietly and then spraying it widely once it becomes public, as it did in 2024 after the disclosure of the Ivanti Connect Secure bugs CVE-2023-46805 and CVE-2024-21887. GTIG assesses with high confidence that the actor will keep using edge-device zero-days to support its espionage. Edge appliances remain the favoured door: earlier this week an Ivanti VPN zero-day was exploited before a fix arrived.
Apply patch BT26-05, then check for compromise
- SaaS customers: BeyondTrust patched all tenants on October 9, 2026. Mandiant's credential and configuration review steps still apply.
- Self-hosted, 24.3.1 or later: apply BT26-05-RS from the /appliance interface, or confirm automatic updates installed it.
- Older than 24.3.1: upgrade to a supported version, then patch. Upgrading does not undo prior exposure.
- Any appliance internet-reachable on a vulnerable version should be treated as potentially compromised until reviewed. Mandiant recommends preserving evidence, collecting off-box syslog, reverse-proxy and firewall logs (the actor wiped on-box logs), and rebuilding suspect appliances from a clean, patched image rather than cleaning them in place.
GTIG's report includes SHA-256 indicators, among them dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb and 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462. Artifacts named in the report include a /usr/bin/dbus-authd binary, a zz-root-persist script in the post_boot.d startup directory, a webshell named mangoapi.php, and an unexpected backend in haproxy.conf.
The lesson repeats every few months. A remote access appliance holds the keys to everything it can reach, and when it falls, the attacker inherits that reach. Patching closes the door, but only a review tells you whether someone already walked through it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.