China's Armory Castle Hackers Quietly Owned BeyondTrust Servers for Weeks Before Anyone Noticed
A Chinese state-linked espionage group known as Armory Castle, previously catalogued under the tracking labels UNC5221 and Warp Panda, exploited a critical zero-day vulnerability in BeyondTrust Remote Support back in late August 2026. The flaw only became public knowledge recently, meaning the attackers had an extended head start.
The vulnerability in question, CVE-2026-102764, carries a CVSS score of 9.3 and stems from improper origin validation inside an internal messaging component. In plain terms: the software wasn't checking where messages were actually coming from, and under the right conditions a remote attacker could use that to run file operations on the appliance. BeyondTrust confirmed this in a security alert last Thursday.
Patches went out to SaaS customers on 9 October 2026. If you're running a self-hosted deployment anywhere between versions 24.3.1 and 26.2.3, you need to manually apply the BT26-05-RS patch. Anything older than 24.3.1 requires a full version upgrade before you can even get the fix. Plan accordingly.
According to BeyondTrust's own timeline, Armory Castle first exploited the flaw on 29 August 2026 against a single self-hosted appliance. BeyondTrust didn't start investigating until 27 September, after public reporting about a separate breach at another security vendor prompted them to go looking for similar patterns. That's nearly a month of dwell time on the initial target.
This group has form. Since October 2023 they've burned zero-days in Citrix NetScaler and multiple Ivanti products to compromise targets across legal services, technology, government, SaaS providers, and business process outsourcers. Their objective is long-term intelligence collection, not smash-and-grab opportunism.
BeyondTrust offered a candid assessment of how Armory Castle operates: they pick high-value software targets in advance, exploit selectively while the vulnerability is unknown, then pivot to mass exploitation the moment a flaw goes public. The company also noted that the group appears to maintain persistent working models of targeted products in an AI context to help build exploit chains. Make of that what you will.
Mandiant, now under Google's ownership, published additional technical detail on what happened after initial access. The attackers deployed a lightweight PHP web shell called SAWFLY, which provided interactive remote access and encrypted command-and-control communications. Traffic was routed through commercial VPN exit nodes and compromised home and small office routers to blend in with normal internet activity.
The post-exploitation activity was thorough and methodical. The attackers copied the system shell binary to a disguised path, set SUID permissions to achieve root-level execution, then used BeyondTrust's own proprietary CLI tool to pull passwords, API keys, and endpoint credentials directly out of the appliance's secrets database. They also abused configuration templates to obtain passwordless root access to the site service account.
From there, they pivoted into the Remote Support application itself, using compromised administrator credentials to launch remote sessions to downstream systems listed in the appliance's Jump Item inventory. That gave them full filesystem access to internal endpoints, which they used to exfiltrate documents and conduct network reconnaissance.
For tunneling, they deployed a custom C-based SOCKS5 proxy tool named BARECLAW, modifying the HAProxy configuration to make it directly internet-accessible. They then cleaned up after themselves by systematically deleting system logs, web server logs, and application-level logs.
Google's Threat Intelligence Group and Mandiant researchers noted that the depth of knowledge Armory Castle demonstrated, specifically their familiarity with proprietary CLI utilities, startup templates, and internal routing configurations, suggests this wasn't opportunistic. Someone studied this product carefully before they touched it.
The advice from the researchers is blunt: if your appliance was running a vulnerable version and was reachable from the internet during that window, treat it as compromised until proven otherwise.