The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.
The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a remote attacker to perform file operations on an affected appliance.
"The vulnerability exists within internal components of Remote Support," BeyondTrust said in a Thursday alert. "The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance."
Patches for the flaw have been pushed to all Remote Support SaaS customers as of October 9, 2026. Self-hosted customers of Remote Support running versions from 24.3.1 through 26.2.3 are advised to manually update to BT26-05-RS patch. Customers running a version older than 24.3.1 will be required to upgrade to a newer version to apply the fix.
According to a timeline of events shared by BeyondTrust, Armory Castle is said to have exploited the flaw as a zero-day on a single self-hosted Remote Support appliance on August 29, 2026. Then, on September 27, 2026, "successful exploitation of another security device provider [became] public," it added, prompting it to initiate an investigation to hunt for similar activity.
Armory Castle has a history of exploiting zero-day vulnerabilities in Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282) appliances to break a wide range of sectors, including legal services, SaaS providers, business-process outsourcers, technology, and governments, for long-term intelligence collection. It's known to be active since October 2023.
"The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched," BeyondTrust said. "Our working assessment is that this actor selects high-value software targets in advance and keeps a working model of the products the actor targets in an AI context that it uses on an ongoing basis to develop exploit chains."
Google-owned Mandiant, which shared additional details related to the exploitation activity, said a successful compromise is followed by the deployment of a lightweight PHP web shell codenamed SAWFLY for interactive remote access and bidirectional encrypted command-and-control (C2) communication.
The operator makes use of commercial VPN exit nodes and compromised home and small-office routers to blend into regular traffic, and then leverages the web shell as a conduit to escalate privileges, obtain full administrative control of the appliance, and establish persistence in a manner that survives reboots.
The intrusion is characterized by efforts to facilitate credential theft by reading the appliance's stored secrets and abusing the administrative access to reach downstream systems and enable lateral movement. Details of the post-exploitation actions undertaken by the threat actor are listed below -
- Gaining root-level control of the appliance host by copying the system shell executable (/bin/sh) to the file "/usr/bin/dbus-authd" and modifying its ownership to root and enabling Set User ID (SUID) permissions, causing it to be executed with the privileges of the file's owner.
- Attempting to harvest credentials directly from the appliance's native secrets management database by using the proprietary "/ns/sbin/bt-secrets" Command Line Interface (CLI) utility to manage, store, and retrieve passwords, API keys, and endpoint credentials.
- Targeting the BeyondTrust configuration templates to obtain passwordless root privileges to the site service account and
- Pivoted into the BeyondTrust Remote Support application to perform reconnaissance via compromised administrator credentials and then launch remote sessions to downstream systems populated within the appliance's Jump Item list.
- Abusing the elevated administrative privileges to establish a remote support session to target internal endpoints and obtain full file-system access to those systems with an aim to download and exfiltrate sensitive internal documents for network reconnaissance.
- Tunneling traffic through the BeyondTrust device via BARECLAW, a C-based custom SOCKS5 proxy tunneler that relays TCP connections between a remote client and destinations.
- Modifying "/ns/config/haproxy.conf" file to ensure BARECLAW is accessible directly from the internet.
- Hindering detection efforts by systematically deleting system, web server, and application-level logs.
"Throughout the intrusion, Armory Castle leveraged a deep understanding of BeyondTrust appliance internals, as evidenced by their abuse of proprietary CLI utilities, startup configuration templates and local reverse-proxy routing," Google Threat Intelligence Group (GTIG) and Mandiant researchers Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, and John Wolfram said.
"Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.