ARMORY CASTLE Exploits BeyondTrust
ARMORY CASTLE Exploits BeyondTrust
On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. The successful exploitation of this vulnerability results in the arbitrary upload of files. During an incident response engagement, Mandiant identified evidence that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor (formerly tracked as UNC5221), exploited this vulnerability as a zero-day in late August 2026. Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public. Mandiant strongly recommends that affected organizations immediately apply the security patches provided by BeyondTrust to remediate the vulnerability and review additional guidance in their blog.
Following the successful exploitation of CVE-2026-102764, Mandiant observed ARMORY CASTLE leverage multiple distinct TTPs to establish a foothold, escalate privileges, and enable lateral movement. Throughout the intrusion, ARMORY CASTLE leveraged a deep understanding of BeyondTrust appliance internals, as evidenced by their abuse of proprietary CLI utilities, startup configuration templates, and local reverse-proxy routing. The threat actor used newly identified custom malware, the SAWFLY webshell and the BARECLAW tunneler to interact with the BeyondTrust device. After successful exploitation, ARMORY CASTLE initiated POST requests to /app_84304470%2Ephp, which resulted in the creation of the SAWFLY webshell at /%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/. SAWFLY (mangoapi.php) is an obfuscated, lightweight PHP webshell that implements bidirectional encrypted C2 communication using a custom Base32 transport layer and a 256-bit RC4 stream cipher.
The SAWFLY webshell initially ran under an unprivileged local user. To escalate privileges, the threat actor copied the system shell executable (/bin/sh) to /usr/bin/dbus-authd, then modified its ownership to root and enabled Set User ID (SUID) permissions, effectively granting a persistent root-level backdoor on the host system and access to all stored credentials. Mandiant observed ARMORY CASTLE harvest credentials directly from the appliance’s native secrets management database, leveraging the proprietary CLI utility /ns/sbin/bt-secrets. They dumped the credential vault using commands such as /ns/sbin/bt-secrets get vault. For long-term persistent access, the threat actor targeted BeyondTrust configuration templates to grant passwordless root privileges to the site service account, creating zz-root-persist in /home/bomgar/sbin/post_boot.d. This ensures privilege escalation survives system reboots and configuration resets.
Throughout their unauthorized access, the threat actor attempted to impair defenses and hinder detection by systematically deleting system, web server, and application-level logs. After the compromise of the BeyondTrust device, the threat actor pivoted into the BeyondTrust Remote Support application to perform reconnaissance via compromised Administrator credentials. The actor directly modified the compromised account’s permissions, upgrading both local Jump Items and Team permissions from No Access to Administrator. This configuration change granted the threat actor permanent, unrestricted authorization to launch remote sessions to downstream systems populated within the appliance’s Jump Item list.
For further details, please refer to the full article: Read full article