SAWFLY (Malware): news timeline & CVEs

BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs

China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.

BeyondTrust said China-nexus actor Armory Castle, formerly UNC5221 and also known as UTA0178, exploited critical Remote Support flaw CVE-2026-102764 as a zero-day beginning August 29, 2026. The 9.3-rated bug is in an internal messaging component that failed to validate message origins, letting attackers remotely control targeted systems. The group deployed its custom PHP webshell SAWFLY within 11 minutes. BeyondTrust says it serves more than 20,000 customers; earlier research found about 11,000 internet-exposed Remote Support instances. Ivanti, Cisco, and Palo Alto Networks also disclosed exploited edge-device flaws the same week.

Dark ReadingOct 16, 20:34 UTC · 7h agoExploit / PoC in the wild 16 sources CVE-2026-102764

Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day

Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.

BeyondTrust, Mandiant and Google confirmed that suspected Chinese espionage group Armory Castle, also tracked as UNC5221, exploited zero-day CVE-2026-102764 in BeyondTrust Remote Support appliances. Activity was traced to August 29, 2026, and a patch plus mitigations are available. Attackers escalated privileges, moved laterally, stole every stored credential and installed custom malware called Sawfly and Bareclaw that survives reboots and resets. Google warns the group often shifts from selective zero-day use to broad exploitation after disclosure, as it did with Ivanti flaws CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.

The Recordupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 13:00 UTC · 15h agoExploit / PoC in the wild 16 sources CVE-2026-102764 CVE-2023-46805

Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

China-linked Armory Castle exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day since August.

Mandiant and Google’s threat intelligence group say China-linked Armory Castle, also tracked as UNC5221 and Warp Panda, exploited BeyondTrust Remote Support flaw CVE-2026-102764 as a zero-day starting August 29, 2026. The CVSS 9.3 bug allows file operations through improper validation of message origins and affects all Remote Support versions through 26.2.3; patch BT26-05-RS covers 24.3.1 through 26.2.3, and BeyondTrust says SaaS customers were patched by October 9. Attackers deployed the Sawfly PHP webshell and Bareclaw SOCKS5 tunneler, obtained root, harvested credentials, deleted logs, and exfiltrated internal documents via the product’s file-transfer feature. The group has previously exploited zero-days in Citrix NetScaler, Ivanti Connect Secure, and Dell RecoverPoint.

SecurityWeekupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 10:53 UTC · 17h agoExploit / PoC in the wild 16 sources CVE-2026-102764

BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert

Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.

Mandiant and Google Threat Intelligence Group say Armory Castle, a suspected China-nexus espionage actor formerly tracked as UNC5221 and by CrowdStrike as WARP PANDA, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 starting Aug. 29, 2026. The unauthenticated flaw, CVSS 9.3, allows file operations, host-level control, and access to credentials the appliance stores or brokers. The actor deployed the SAWFLY PHP web shell, a SUID root backdoor, passwordless sudo persistence, and the BARECLAW SOCKS5 tunneler, then wiped logs. BeyondTrust released a patch on Oct. 8 in advisory BT26-05; self-hosted internet-exposed systems should be reviewed, while SaaS instances were patched automatically.

CSO Onlineupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 10:24 UTC · 17h agoExploit / PoC in the wild 16 sources CVE-2026-102764

China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns

Google says China-linked Armory Castle exploited critical BeyondTrust flaw CVE-2026-102764 and retained root on appliances.

Google warned that Armory Castle, a suspected China state-sponsored espionage actor active since October 2023, exploited critical BeyondTrust Remote Support flaw CVE-2026-102764 in August 2026. The vulnerability has a CVSS score of 9.3; BeyondTrust disclosed it on October 15 after shipping a patch on October 8 and is withholding technical details. Post-exploitation included the Sawfly PHP web shell, a SUID root backdoor, credential harvesting with bt-secrets, Administrator Jump permissions, the Bareclaw tunneler, and log deletion. Google said the group and others may move to broad opportunistic exploitation and advised customers to patch, restrict appliance access, rotate credentials, and rebuild compromised systems.

Infosecurity Magazineupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 10:10 UTC · 18h agoExploit / PoC in the wild 16 sources CVE-2026-102764

BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes

Attackers exploited BeyondTrust Remote Support zero-day CVE-2026-102764 from August to gain full admin access.

Mandiant says suspected China-nexus espionage group ARMORY CASTLE, previously UNC5221 and also called WARP PANDA, exploited CVE-2026-102764 in BeyondTrust Remote Support starting August 29, 2026. The unauthenticated flaw, in versions through 26.2.3, allows remote file operations that can lead to full host control. Attackers installed the SAWFLY PHP web shell, escalated to root, persisted with a startup script, tunneled traffic using BARECLAW, expanded Jump Item access, collected data, and deleted logs. BeyondTrust patched on October 8, hosted tenants were updated by October 9, and a precautionary Privileged Remote Access patch was also released.

Cyber Security Newsupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 08:17 UTC · 19h agoExploit / PoC in the wild 16 sources CVE-2026-102764

Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors

China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access and persistent backdoors.

Google Threat Intelligence Group and Mandiant say China-nexus group ARMORY CASTLE, previously UNC5221, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 in late August 2026, before the October 15 disclosure. The unauthenticated flaw enabled remote file operations; attackers deployed the SAWFLY PHP webshell, escalated to root with a SUID binary, read the secrets vault, and installed the BARECLAW SOCKS5 tunneler. BeyondTrust patch BT26-05 covers supported versions through 26.2.3. SaaS tenants were patched on October 9, and appliances that may have been compromised should be rebuilt rather than only rebooted.

Cyber Security Newsupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 07:07 UTC · 21h agoExploit / PoC in the wild 16 sources CVE-2026-102764

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.

BeyondTrust said CVE-2026-102764, CVSS 9.3, is improper origin validation in Remote Support internal messaging that lets a remote attacker perform file operations. China-nexus group Armory Castle, also tracked as UNC5221 and Warp Panda, exploited it as a zero-day on August 29, 2026 against one self-hosted appliance. SaaS customers were patched by October 9; self-hosted versions 24.3.1 through 26.2.3 need patch BT26-05-RS. Mandiant reported follow-on use of the SAWFLY PHP web shell, SUID privilege escalation, secret harvesting, Jump remote sessions, the BARECLAW SOCKS5 tunneler, and log deletion.

The Hacker Newsupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 06:55 UTC · 21h agoExploit / PoC in the wild 16 sources CVE-2026-102764 CVE-2023-4966

BeyondTrust patches zero-day exploited in attacks since August

BeyondTrust patched CVE-2026-102764, a Remote Support authentication bypass exploited since August by China-linked Armory Castle.

BeyondTrust patched CVE-2026-102764, a critical authentication bypass in Remote Support 26.2.3 and earlier that lets unprivileged remote attackers perform file operations. Mandiant and Google Threat Intelligence Group say China-nexus Armory Castle, also UNC5221 and CrowdStrike's Warp Panda, exploited it since late August, gained root through SUID permissions, deployed the Sawfly web shell and Bareclaw tunneler, wiped logs, and moved laterally with stolen administrator credentials. SaaS customers were patched on October 8, while self-hosted systems require a manual update. Shadowserver tracks more than 1,400 exposed instances, and Mandiant warned exploitation may broaden now that the flaw is public.

BleepingComputerOct 16, 06:18 UTC · 21h agoExploit / PoC in the wildCVE-2026-102764 CVE-2023-4966 CVE-2023-46805+5 CVEs1· 1 read

Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access

China-linked ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 for root access before disclosure.

Mandiant says suspected China-linked espionage group ARMORY CASTLE, previously UNC5221, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 in late August 2026, weeks before the October 15 disclosure. Attackers uploaded a file, deployed the SAWFLY PHP webshell, and copied a shell with the SUID bit to gain root from an unprivileged service account. They queried the bt-secrets credential utility, planted sudoers persistence, deleted logs, and expanded portal permissions to reach internal systems. A custom tunneler, BARECLAW, relayed TCP over a SOCKS5 WebSocket proxy exposed through HAProxy. BeyondTrust has issued patches; prior root-level compromise may persist after patching.

GBHackersupdated Oct 16, 20:34 UTC · 7h agofirst Oct 16, 04:59 UTC · 23h agoExploit / PoC in the wild 16 sources CVE-2026-102764

ARMORY CASTLE Exploits BeyondTrust

Suspected China-nexus group ARMORY CASTLE exploited BeyondTrust zero-day CVE-2026-102764 to steal appliance credentials.

Mandiant says ARMORY CASTLE, a suspected China-nexus espionage actor formerly tracked as UNC5221, exploited BeyondTrust Remote Support CVE-2026-102764 as a zero-day in late August 2026. The vulnerability allows arbitrary file upload. After entry, the actor used the SAWFLY PHP webshell and BARECLAW tunneler, created a root SUID shell, extracted credentials with the appliance's bt-secrets utility, and removed logs. BeyondTrust has issued patches, and Mandiant expects other actors may exploit the bug widely.

Google Threat Intelligenceupdated Oct 16, 20:34 UTC · 7h agofirst Oct 15, 14:00 UTC · 1d agoThreat actor in the wild 16 sources CVE-2026-1027647

SAWFLY

Timeline11 articles

Related CVEsby mentions

Appears with