Executive Summary
In late August 2026, the suspected PRC-nexus espionage actor ARMORY CASTLE (formerly UNC5221) exploited a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support appliances. The vulnerability allows unauthenticated arbitrary file uploads, which the actor used to gain host-level control and establish persistence on target systems. This activity follows a historical pattern of the actor targeting edge appliances to facilitate long-term espionage objectives.
Technically, the actor deployed the SAWFLY PHP webshell to maintain access and utilized a custom SOCKS5 tunneler named BARECLAW to proxy traffic through the appliance. They demonstrated a deep understanding of the appliance's internals by abusing proprietary CLI tools like `bt-secrets` to dump credentials and modifying HAProxy configurations to hide their backdoor listeners from external scanning. Persistence was achieved by tampering with startup script templates to grant passwordless sudo privileges to a site service account.
This campaign is highly significant as BeyondTrust appliances often sit at the intersection of internal networks and the internet, serving as brokers for administrative access. Compromise of these devices provides attackers with access to stored secrets and the ability to pivot laterally into internal endpoints via established remote support sessions. Organizations are urged to apply the BT26-05 patch immediately.