DEV Community

Anoymask
Anoymask

Posted on

BeyondTrust CVE-2026-102764: ARMORY CASTLE Exploits Zero-Day to Deploy SAWFLY and BARECLAW

#security #threatintel

1. Overview

A pre-authentication file operation vulnerability was exploited in active attacks. Observed activity includes web shell deployment, subsequent privilege escalation, establishment of an inbound WebSocket tunnel from the internet, local log deletion, and unauthorized use of administrator accounts.

2. Executive Summary

ARMORY CASTLE, an espionage group with suspected links to China, exploited a zero-day vulnerability in BeyondTrust Remote Support (CVE-2026-102764) in late August 2026. The actors deployed the SAWFLY web shell and the BARECLAW backdoor, established inbound tunnel connections via HAProxy, and modified administrator account privileges.

3. Attack Flow

The following outlines the recorded compromise activity and does not imply that every victim organization experienced the exact same sequence or combination of actions.

Path 1: Pre-Authentication Exploitation and Observed Subsequent Actions

  1. The attacker exploits a pre-authentication vulnerability in an internet-facing Remote Support appliance. The vendor describes the issue as a file manipulation flaw caused by improper sender verification for internal messages, while GTIG reports it as arbitrary file upload.
  2. The SAWFLY web shell is executed with the service account privileges of the site, followed by privilege escalation to administrator and persistence establishment. Exploitation of the vulnerability alone does not automatically grant root privileges.
  3. The BARECLAW backdoor is configured to listen on local TCP port 19800, and a forwarding rule is added for incoming traffic to /uidchanarge in HAProxy. The observed connection path is an inbound WebSocket connection originating from the internet.
  4. The actors attempted to extract credentials from the credential vault. Separately, they logged into the management console using a compromised Administrator account and modified access permissions for Jump Items and Teams. The success of vault extraction and the origin of the compromised Administrator credentials cannot be conclusively determined from public information alone.
  5. After establishing legitimate Remote Support sessions to internal endpoints, the actors obtained file system access permissions and retrieved and exfiltrated internal documents, such as software inventories, via the legitimate file transfer service. The scope of arbitrary command execution on each connected endpoint has not been publicly disclosed.
  6. Local logs and operational artifacts were deleted at multiple stages of the intrusion activity.

4. Attacker Positioning and Execution Location

  • Remote attackers with network reachability to the internet-facing Remote Support appliance prior to authentication.
  • Following initial access, privilege escalation was performed on the appliance, accompanied by unauthorized use of administrator accounts and modification of connection access permissions.

5. Visibility for Victims and Administrators

  • Victims and Users: Normal Remote Support usage interfaces may show no prominent anomalies.
  • Administrators: Observable indicators include suspicious requests targeting the appliance, creation of unknown files, execution of SAWFLY and BARECLAW, HAProxy configuration modifications with inbound WebSocket traffic, missing logs, and suspicious remote connections initiated by administrator accounts.

6. Conditions for Success and Failure

Conditions for Success

  • The attacker has network reachability to a vulnerable BeyondTrust Remote Support appliance (version 26.2.3 or earlier).
  • Patch BT26-05-RS is not applied, leaving the appliance unable to prevent arbitrary file placement and execution.

Failure Conditions and Mitigations

  • Promptly apply patch BT26-05-RS and disable unnecessary external exposure.
  • If compromise is suspected, isolate the appliance at the network boundary, revoke all credentials brokered by the appliance, and terminate all active sessions.

7. Outcomes upon Success

  • Deployment of a web shell and subsequent privilege escalation to take control of the appliance, maintaining persistent external access via HAProxy.
  • Use of compromised administrator accounts for legitimate remote connections to internal endpoints, exfiltration of internal documents, risk of exposure for stored and brokered credentials, and erasure of local logs.

8. Observable Logs

The following items are candidates for internal investigation. Feasibility depends on product features, permissions, log configurations, and retention periods; the absence of records does not prove an uncompromised state.

  • Email: No email vectors specific to this incident have been identified.
  • Proxy / SWG / DNS: Inference: Check for requests sent from external sources to unknown PHP paths or WebSocket Upgrade traffic. Because the path observed for BARECLAW involves inbound traffic routed through HAProxy, monitoring should not be restricted solely to outbound communications from the appliance.
  • Endpoint / EDR: Verify unknown file creation associated with SAWFLY or BARECLAW, suspicious execution originating from web service processes, and file or log deletion activities.
  • Identity / IdP: Monitor for logins to the management console using Administrator accounts, permission modifications for Jump Items or Teams, and check whether stored or brokered credentials have been used by unknown hosts.
  • SaaS / Cloud: Organizations using the BeyondTrust SaaS environment should review management actions and session histories prior to the application of the fix on October 9.
  • Network: Check for inbound WebSocket traffic from the internet, configuration rules forwarding traffic from HAProxy /uidchanarge to local TCP port 19800, and investigate internal connection attempts separately from successfully established connections.

9. Attack Success Assessment

Confirmed by Public Information

  • Subsequent Compromise Confirmed: Public sources: GTIG/Mandiant have confirmed web shell placement, privilege escalation and persistence, BARECLAW deployment, log deletion, and permission modifications via Administrator accounts, in addition to legitimate remote connections to internal endpoints and internal document exfiltration using file transfer features. Note that while BeyondTrust reported two impacted customer organizations, it is not established that every listed operation occurred in both organizations. Scope: GTIG public compromise records (distinguishing the scope of confirmation from BeyondTrust's total count of two impacted customer organizations)

Distinguish contact, execution, persistence, information retrieval, and exfiltration; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Initiate investigations based on the use of Remote Support versions 26.2.3 or earlier, unapplied patch BT26-05-RS, or suspicious traffic and configuration changes on the appliance.
  • Initial Verification: Confirm running versions, patch application status, external exposure scope, session history since August 29, and the presence of external log forwarding.
  • Endpoint and Server Investigation: Preserve snapshots, memory, disk, and logs including access, syslog, messages, thin-scc, brain, and SSL-related logs to investigate unknown files and evidence of log deletion.
  • Authentication and Cloud Investigation: Track credentials brokered by the appliance, administrator accounts, Remote Support sessions, and IdP token usage histories.
  • Subsequent Operations: Inference: Track connected endpoints, retrieved documents, external exfiltration, and additional payload deployment, including legitimate Remote Support sessions and file transfer histories. Although GTIG confirmed internal document exfiltration, verify the scope of impact within your own organization using actual logs rather than relying solely on access permission modification histories.
  • Containment: Isolate the target appliance from the network, preserve forensic evidence, apply patches, forcefully terminate all sessions, and rotate all brokered credentials.
  • Assessment Categories: Evaluate step by step, separating vulnerability scans, file uploads, web shell execution, tunnel establishment, unauthorized credential use, and lateral movement to internal endpoints.

11. Defense and Detection Ideas

  • Single Events: Detect unknown shells or binary executions spawned by Remote Support service processes and log file deletion activities with high priority.
  • Timeline Correlation: Correlate pre-authentication suspicious requests, unknown file or web shell creation, HAProxy configuration changes with inbound WebSocket traffic, management console logins and permission changes, and log deficiencies along a timeline.
  • Threat Hunting: Cross-check all Remote Support appliances for versions, patch status, unknown files, external communications, and administrator account usage histories since late August.
  • Log Limitations: Because attackers delete local logs on the appliance, failure to forward logs to an external SIEM/syslog server or retain network traffic records may prevent accurate identification of the initial intrusion time and operational scope.
  • Priority Mitigations: Prioritize applying patch BT26-05-RS, reducing external exposure scope, configuring real-time external log forwarding, and revoking and reissuing brokered credentials.

12. Facts / Inference / Hypothesis

Facts

  • GTIG/Mandiant confirmed evidence of zero-day exploitation of CVE-2026-102764 by ARMORY CASTLE in late August 2026. ARMORY CASTLE is an espionage-focused threat group with suspected links to China, previously tracked as UNC5221.
  • CVE-2026-102764 is a vulnerability caused by improper sender verification for internal messages. BeyondTrust published it as a file manipulation issue (CWE-290) with a CVSS v4.0 score of 9.3, whereas GTIG describes it as an arbitrary file upload. The affected scope is Remote Support 26.2.3 and earlier.
  • GTIG's compromise records confirm the deployment of SAWFLY, subsequent privilege escalation and persistence, HAProxy inbound traffic forwarding to BARECLAW, log deletion, and management logins and permission changes via the Administrator account. Furthermore, legitimate Remote Support connections to internal endpoints and internal document exfiltration (such as software inventories) via file transfer features were observed. However, the success of credential vault extraction, the source of the compromised Administrator credentials, and the full extent of arbitrary command execution on connected endpoints have not been publicly disclosed.
  • According to BeyondTrust, two customer organizations were confirmed to be affected, and no additional evidence of the same activity has been identified since August 2026. The cloud (SaaS) environment was patched on October 9, 2026.
  • For on-premises (self-hosted) environments, patch BT26-05-RS must be applied to version 26.2.3 and earlier. Environments running versions prior to 24.3.1 must first be updated to a supported version.

Inference

  • Because actors have been observed erasing local logs on the appliance, relying solely on records internal to the appliance risks underestimating the scope of impact. Investigations should combine externally forwarded syslog data, IdP logs, EDR telemetry from connected endpoints, and boundary network traffic records.

Hypothesis

No additional hypotheses. Unverified items are documented in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Zero-day exploitation of a pre-authentication vulnerability in an externally exposed Remote Support appliance. Source
T1505.003 Server Software Component: Web Shell high The SAWFLY web shell was deployed on the appliance. Source
T1070.004 Indicator Removal: File Deletion high Deletion of local logs was confirmed on the compromised appliance. Source
T1021 Remote Services high Legitimate Remote Support sessions were established to connect to internal endpoints, and internal documents were retrieved and exfiltrated via file transfer services, distinct from arbitrary command execution on endpoints. Source

14. Unknowns and Additional Investigation

  • Aside from the observed exfiltration of internal documents, information allowing third parties to independently verify the full extent of exfiltrated data, the industry sectors or regions of the two affected organizations, and the presence of additional victims since August has not been publicly released.
  • The success of credential vault extraction, the specific acquisition path for compromised Administrator credentials, the list of all connected endpoints, and the scope of arbitrary command execution on connected targets remain undisclosed. However, legitimate remote connections to internal endpoints and document exfiltration have been confirmed.

15. Impact on SOCs and Organizations

Remote Support appliances serve as critical focal points consolidating privileged operations and numerous managed credentials. Organizations should not only verify external exposure status but also preserve snapshots before and after patch application, review externally forwarded logs, and investigate usage histories of credentials brokered by the appliance. If signs of compromise are identified, prioritize forcibly terminating active sessions and rotating all brokered credentials.

16. Summary by Role

  • For SOC Teams: Preserve access, syslog, messages, thin-scc, brain, and SSL logs along with external communication records to track traces of SAWFLY and BARECLAW, log deletion, and unauthorized use of administrator credentials.
  • For Administrators: Update on-premises environments to a supported version and apply patch BT26-05-RS. If compromise is suspected, isolate the appliance and rotate all brokered credentials.
  • For Users: This is a server-side attack requiring no user interaction. Promptly follow any instructions from administrators regarding re-authentication or password changes.

Top comments (0)