China-Linked Hackers Exploited BeyondTrust Remote Support Zero-Day Since August

China-Linked Armory Castle Exploited BeyondTrust Remote Support Zero-Day Since Late August

BeyondTrust disclosed CVE-2026-102764, a critical (CVSS 9.3) authentication/origin-validation flaw in its Remote Support (RS) product, confirming it was actively exploited as a zero-day starting in late August 2026 — roughly seven weeks before public disclosure on October 15-16, 2026. Mandiant and Google Threat Intelligence Group (GTIG) attribute the exploitation to a suspected China-nexus espionage actor tracked as Armory Castle (formerly UNC5221, also tracked by CrowdStrike as Warp Panda), the same cluster previously linked to zero-day exploitation of Citrix NetScaler (CVE-2023-4966) and multiple Ivanti Connect Secure flaws. BeyondTrust's Remote Support and Privileged Remote Access (PRA) appliances broker remote-control sessions and credentials for an estimated 20,000+ customers, including roughly 75% of Fortune 100 companies — making the appliance itself one of the most trusted and highest-value footholds on a corporate network.

Details

How the Attack Worked

Initial Access: Unauthenticated File Upload

Armory Castle exploited the origin-validation weakness in Remote Support's internal messaging component to perform unauthenticated file operations against unpatched appliances. Mandiant's reconstruction traces the first confirmed activity to August 29, 2026, against a single self-hosted appliance. The intrusion began with a POST request to an obfuscated path (app_84304470%2Ephp); roughly 11 minutes later, a webshell appeared live in the web root, running under an unprivileged service account.

Webshell Deployment: SAWFLY

The attackers planted a lightweight, obfuscated PHP webshell that GTIG codenamed SAWFLY (observed as mangoapi.php). SAWFLY provides interactive remote access and bidirectional, encrypted command-and-control: it inspects incoming POST requests for a hardcoded parameter, and if that parameter is absent it returns an HTTP 404 to evade scanners and casual inspection. When present, it Base32-decodes the payload, decrypts it with a hardcoded 256-bit RC4 key, executes it via eval(), then encrypts and Base32-encodes the response before returning it — giving the operators a low-footprint, authenticated-looking channel into the appliance.

Privilege Escalation to Root

From an unprivileged foothold, the attackers escalated to root using appliance-specific tradecraft rather than a separate kernel exploit. They copied a system shell to a path disguised as a legitimate daemon (/usr/bin/dbus-authd), set root ownership, and enabled the SUID bit, creating a persistent root-level backdoor that survives reboots. In parallel, they planted a post-boot script (zz-root-persist) under /home/bomgar/sbin/post_boot.d/ that appends a passwordless-sudo entry to the appliance's sudoers.template — a configuration file that survives reboots and resets — and then re-runs the appliance's own bt-sysconfig utility to rebuild /etc/sudoers from it, re-establishing privileged access even after remediation attempts that don't address the template itself.

Credential Theft and Tunneling

With root access, Armory Castle used the proprietary bt-secrets CLI utility to dump the appliance's credential vault — site service-account passwords, API keys, and other brokered secrets — then deleted bt-secrets.log to cover its tracks. The group also deployed BARECLAW, a custom C-based SOCKS5-over-WebSocket tunneler (observed as ingredi_ws) bound to an internal-only port, and modified the appliance's HAProxy configuration to add a hidden backend route, exposing the tunnel to the internet without appearing in a normal external port scan.

Lateral Movement via Jump Items

Using stolen administrator credentials, the attackers logged into the Remote Support web portal and modified account permissions directly — upgrading target accounts' Jump Item and team roles from "No Access" to "Administrator." This gave them standing, legitimate-looking authorization to launch remote-support sessions against every endpoint the appliance manages, which they used to browse file systems, pull software inventories and configuration data, and exfiltrate documents from user desktops via the appliance's built-in file-transfer feature.

Anti-Forensics

Before and after the above steps, the group systematically deleted authentication, SSL, HTTP, PHP-FPM, Docker, and system logs on the appliance (including /var/log/messages and SSH authentication logs), aiming to erase evidence of both the initial exploitation and the subsequent privilege escalation and lateral movement.

Impact Assessment

Recommendations

For BeyondTrust Administrators

Apply BT26-05 immediately. SaaS tenants were patched automatically on October 8-9, 2026; self-hosted customers running 24.3.1 ≤ version ≤ 26.2.3 must apply the patch manually through /appliance unless automatic updates are enabled, and appliances on versions below 24.3.1 must upgrade to a supported release first. Patching alone does not remove an existing compromise — any appliance that was internet-exposed and unpatched during the late-August-through-October-8 window should be treated as potentially compromised until forensically reviewed.

For Security and Incident Response Teams

Before making changes, preserve forensic evidence: snapshot virtual appliance memory and disk, export hardware appliance disks, and request SaaS forensic preservation from BeyondTrust directly, since an attacker with root can delete on-appliance logs. Pull perimeter firewall and reverse-proxy/WAF logs covering the full exposure window, since these can't be altered by an appliance-level attacker. Hunt specifically for the SUID copy at /usr/bin/dbus-authd, the persistence script zz-root-persist under /home/bomgar/sbin/post_boot.d/, unexpected entries in /ns/config/sudoers.template, and HAProxy ACL/backend entries referencing unfamiliar paths. If root-level persistence or log deletion is confirmed, rebuild the appliance from a clean, patched image rather than attempting to remediate in place, and restore configuration only from a backup taken before the exposure window.

For Credential and Access Hygiene

Rotate credentials in dependency order once the appliance is patched and trusted: /appliance administrative credentials first, then /login administrator and local accounts, API client secrets, identity-provider bind accounts and SAML signing keys, the Remote Support vault and any integrated password managers, and finally integration credentials for SMTP, syslog, and ITSM connectors. Any credential typed into a support session during the exposure window should also be considered exposed. Going forward, require SAML SSO with phishing-resistant MFA for /login, remove local accounts other than a vaulted break-glass account, set default Jump Item roles to "No Access" and grant access through policy rather than per-user, and restrict /login and /appliance access by IP or network segment.

For All Organizations Running Remote-Access Appliances

Treat internet-facing remote-support and privileged-access appliances as Tier-0 infrastructure: forward syslog to a SIEM over TLS with multi-month retention (an appliance attacker with root will delete local logs), monitor for Jump Item or team role changes without a corresponding change ticket, flag administrative logins from residential or commercial VPN IP ranges or outside business hours, and apply default-deny egress filtering so a planted tunneler like BARECLAW cannot reach out even if deployed.

Key Takeaways

1. CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support was exploited as a zero-day from late August 2026, roughly seven weeks before the October 15-16 public disclosure.
2. The China-nexus actor Armory Castle (formerly UNC5221/Warp Panda) — previously tied to Citrix NetScaler and Ivanti Connect Secure zero-days — used the flaw to go from unauthenticated file upload to full root in minutes.
3. The intrusion deployed two custom tools: the SAWFLY PHP webshell (RC4/Base32-obfuscated C2) and the BARECLAW SOCKS5-over-WebSocket tunneler, hidden behind a modified HAProxy configuration.
4. Attackers escalated privileges via a disguised SUID shell copy and a sudoers-template persistence mechanism designed to survive reboots and config resets, then harvested the appliance's credential vault.
5. BeyondTrust patched SaaS tenants automatically on October 8-9; self-hosted customers on versions 24.3.1 ≤ version ≤ 26.2.3 must patch manually, and Google warns of expected widespread opportunistic exploitation now that the flaw is public.
6. Patching does not undo an existing compromise — any exposed appliance from the exploitation window needs forensic review, credential rotation, and likely a rebuild from a clean image before it can be trusted again.

Sources

• BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August
• The Hacker News: China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
• Google Cloud Blog: ARMORY CASTLE Exploits BeyondTrust