ARMORY CASTLE Exploits BeyondTrust

What it is

Mandiant's incident-response write-up of ARMORY CASTLE (formerly UNC5221, suspected PRC-nexus) exploiting CVE-2026-102764 in BeyondTrust Remote Support as a zero-day in late August 2026. BeyondTrust disclosed the flaw on 15 October 2026. It is an unauthenticated arbitrary file upload that leads to host-level control. It affects all supported versions up to 26.2.3.

How it works

After exploitation, the actor POSTed to /app_84304470%2Ephp. Mandiant could not recover that file. About 11 minutes later the SAWFLY webshell (mangoapi.php) appeared under the site's ingredi/app/laravel/public/ web root.

• SAWFLY: it reads POST parameter _c94mfe, Base32-decodes it, RC4-decrypts it with a hardcoded 32-byte key and runs the result with @eval(). Without the parameter it returns 404.
• Root escalation: /bin/sh was copied to /usr/bin/dbus-authd, then chowned to root with the SUID bit set.
• Credential theft: /ns/sbin/bt-secrets get vault was run in three syntax variants, then /home/bomgar/log/bt-secrets.log* was deleted.
• Persistence: the script /home/bomgar/sbin/post_boot.d/zz-root-persist appends %SITE_SERVICE_ACCOUNT% ALL=(ALL) NOPASSWD: ALL to /ns/config/sudoers.template, then runs /ns/sbin/bt-sysconfig --no-restart misc to rebuild /etc/sudoers. This survives reboot and configuration reset.
• Tunnel: BARECLAW, a C SOCKS5-over-WebSocket tunneler, ran as /tmp/ingredi_ws --listen 19800 --token %REDACTED% --obfs -q --ws-path /uidchanarge. TLS was not enabled.
• Exposure: haproxy.conf was edited with ACL wswsws for path /uidchanarge, routing to backend webskd3 at 127.0.0.1:19800. The listener is therefore not visible to external port scans.
• Lateral movement: the actor logged in with stolen Administrator credentials and raised the account's Jump Item and Team roles from No Access to Administrator. It then opened sessions to internal endpoints and pulled files such as software inventories through the file-transfer service.
• Anti-forensics: a single rm -f removed /ns/log/* logs, /var/log/messages, the site httpd_* logs and /tmp/sshauth.*.

Preconditions / Affected

Self-hosted and SaaS Remote Support up to 26.2.3. BeyondTrust patched SaaS tenants on 9 October 2026. Any internet-reachable vulnerable appliance during the exposure window should be treated as potentially compromised. Mandiant warns of mass exploitation after disclosure, as with CVE-2023-46805 and CVE-2024-21887 in 2024.

What to do

Patch (Mandiant recommended). Apply BT26-05-RS from /appliance on 24.3.1 or later. Older versions must upgrade first, which closes the hole but does not remove prior compromise. If the patch is not visible, open a case with BeyondTrust Support citing BT26-05.

If compromise is possible:

1. Snapshot virtual appliances with memory and export the disk before any change or reboot. Collect syslog, WAF or proxy and firewall logs, since on-box logs may be deleted.
2. Block inbound traffic at the perimeter firewall, not in /appliance, and deny egress except BeyondTrust endpoints.
3. Disable (do not delete) sessions, Jump Clients, Jumpoints and API accounts.
4. Rebuild from a clean patched image. Customers cannot audit the host file system. Restore only a configuration backup from before the exposure window.
5. Rotate credentials only after patching or rebuilding, in this order: /appliance admins; /login admins and users; API secrets; bind accounts and SAML signing keys; Vault and Password Safe or PRA credentials; integration credentials; anything typed into a session.

Hunt:

• Alert on user_changed events that raise a Jump Item or team role, on /login successes from residential or VPN address space, on off-hours admin logins, and on file transfers.
• At a reverse proxy or WAF, flag unknown .php paths and WebSocket upgrades from non-support ranges.
• Treat syslog forwarding gaps as log tampering.
• Review session reports; every endpoint touched is in scope for downstream hunting.
• YARA rules G_Hunting_Webshell_SAWFLY_1 and G_Hunting_Backdoor_BARECLAW_1 are in the post. IOCs are in a GTI Collection for registered users.

Compensating controls (not a patch substitute): restrict /login and /appliance by IP, require SAML with phishing-resistant MFA, set the default Jump Item role to No Access, and scope API accounts minimally.

Caveats

The staging file behind /app_84304470%2Ephp was not recovered. Evidence of exploitation sits in logs on a LUKS-encrypted partition that customers cannot easily reach. The BARECLAW path, port, token and filename are from one intrusion and may differ elsewhere.