In a recent development, a Chinese advanced persistent threat (APT) group has been identified exploiting a vulnerability in BeyondTrust software. This flaw, noted as CVE-2026-102764 with a critical CVSS score of 9.3, has been part of state-sponsored espionage activities since August.
Vulnerability Details and Impact
The identified flaw involves improper validation of message origins, potentially allowing attackers to manipulate file operations on Remote Support (RS) appliances. BeyondTrust disclosed that versions up to 26.2.3 are affected, with a patch released in the BT26-05-RS update for versions 24.3.1 through 26.2.3. Users with versions older than 24.3.1 are advised to upgrade and apply the patch.
BeyondTrust discovered this security issue on September 28, a day after its public exposure. The initial exploitation was reported on August 29, involving one BeyondTrust-hosted and one self-hosted RS appliance. A patch was developed by September 30, with additional testing completed before its release on October 8.
Exploitation by Armory Castle
According to Mandiant and the Google Threat Intelligence Group (GTIG), the Chinese-linked threat actor known as Armory Castle has been exploiting this zero-day vulnerability. This group, also referred to as UNC5221 and Warp Panda, is focused on gathering intelligence by targeting SaaS providers, tech companies, and governmental organizations.
The APT gained initial access by targeting a BeyondTrust device, deploying their Sawfly webshell and Bareclaw tunneler to interact with the device, escalate privileges, and move within the compromised network. Sawfly, a PHP webshell with encrypted command-and-control capabilities, served as their main foothold within the environment.
Methodology and Tools
After establishing control, Armory Castle obtained root-level access, harvested credentials, and erased system logs. By leveraging compromised administrator credentials, they modified account permissions to gain control of remote systems and target internal networks. BeyondTrust’s native file transfer service was exploited to exfiltrate sensitive documents.
The group also utilized Bareclaw, a custom SOCKS5 proxy tunneler, for data encryption and traffic management. GTIG reports that Armory Castle has previously exploited multiple vulnerabilities in edge appliances, demonstrating their capability to deploy a range of custom tools for espionage purposes.
Armory Castle’s activities date back to October 2023, with operations targeting various countries and sectors. Their history includes exploiting zero-day vulnerabilities across multiple platforms, underscoring the persistent threat they pose to global cybersecurity.
