Did ARMORY CASTLE Use BeyondTrust Zero-Day to Gain Root Access on Remote Appliances?

A suspected China-nexus espionage group known as ARMORY CASTLE exploited a critical zero-day vulnerability in BeyondTrust Remote Support appliances in late August 2026. The attack occurred weeks before the vendor disclosed the flaw on October 15, 2026, according to a joint analysis by BeyondTrust and Mandiant.

The attackers used the vulnerability, tracked as CVE-2026-102764, to upload files to internet-facing appliances. Mandiant reported that the group leveraged this access to move from an unprivileged web service account to root privileges. They then stole credentials, altered permissions, and created tunneling routes into victim networks.

Technical details of the exploit

The flaw involves improper origin validation in an internal messaging component, allowing remote attackers to perform file operations without authentication. According to The Hacker News, the CVSS score is 9.3, which is classified as critical. After initial exploitation, the group sent POST requests to a specific PHP endpoint.

Mandiant noted that about 11 minutes later, the appliance recorded the creation of a PHP webshell named SAWFLY. This lightweight implant uses custom Base32 transport and RC4 encryption. It returns a 404 error when its expected parameter is absent, helping it evade routine scanners.

Who is affected

BeyondTrust confirmed that patches were pushed to all Remote Support SaaS customers by October 9, 2026. Self-hosted customers running versions 24.3.1 through 26.2.3 must manually update to patch BT26-05-RS. Users on versions older than 24.3.1 must upgrade to a newer version to apply the fix, according to The Hacker News.

ARMORY CASTLE, previously tracked as UNC5221, has a history of targeting infrastructure appliances. BeyondTrust stated the actor typically selects high-value software targets in advance and keeps working models of products to develop exploit chains.

Next steps

Organizations should verify their BeyondTrust Remote Support version immediately. If you are on a supported self-hosted version, apply patch BT26-05-RS. For older versions, plan an upgrade to a supported release. Monitor logs for unusual file uploads or privilege escalation attempts on the appliance.

Signals worth monitoring

Teams should review web server logs for POST requests to unusual PHP endpoints or files with encoded names. Look for the creation of new files in web-root directories shortly after such requests. Check for unexpected changes to system binaries, particularly copies of shell utilities with set-user-ID bits enabled. Monitor for outbound connections from the appliance that do not match normal management traffic patterns. Investigate any deletions of log files or archived records related to secrets management utilities.

What to do and how to stay safe: BeyondTrust

• Verify your BeyondTrust Remote Support version against the vendor's advisory to determine if you are affected.
• Apply the recommended patch or upgrade to a supported version as soon as possible.
• Review appliance logs for unauthorized file uploads or privilege escalation events.
• Monitor for unusual outbound traffic that could indicate tunneling or data exfiltration.

Step-by-step guide: Phishing Defined: Anatomy of the Attack and Risk Reduction

General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-102764?

It is a critical vulnerability in BeyondTrust Remote Support that allows unauthenticated remote attackers to perform file operations on the appliance.

Who is ARMORY CASTLE?

It is a suspected China-nexus espionage group previously tracked as UNC5221, known for exploiting zero-days in infrastructure appliances.

Are SaaS customers affected?

BeyondTrust stated that patches were pushed to all Remote Support SaaS customers by October 9, 2026.