China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 and deployed the SAWFLY webshell.
BeyondTrust said China-nexus actor Armory Castle, formerly UNC5221 and also known as UTA0178, exploited critical Remote Support flaw CVE-2026-102764 as a zero-day beginning August 29, 2026. The 9.3-rated bug is in an internal messaging component that failed to validate message origins, letting attackers remotely control targeted systems. The group deployed its custom PHP webshell SAWFLY within 11 minutes. BeyondTrust says it serves more than 20,000 customers; earlier research found about 11,000 internet-exposed Remote Support instances. Ivanti, Cisco, and Palo Alto Networks also disclosed exploited edge-device flaws the same week.
CVE-2026-102764 scores 9.3 and involves improper message-origin validation.
Armory Castle, also UNC5221 and UTA0178, exploited it as a zero-day from August 29, 2026.
Attackers deployed the custom PHP webshell SAWFLY within minutes.
BeyondTrust cites more than 20,000 customers, including 75 Fortune 100 companies.
Ivanti, Cisco, and Palo Alto also disclosed exploited edge bugs this week.
Message-origin spoofing enables file ops on BeyondTrust Remote Support
published · BeyondTrust Remote Support KEV PoC
CVE
Vulnerability
CVSS
EPSS
Flags
Affected
Exposure
Published
Indicators of compromiseauto-extracted · verify before use · export allAll →
Type
Indicator
Context
md5
0c2bf78193ce890be6758a839f600144
new-ways-hack-vehicles#recipe=similar-items&sourcecontentid=0c2bf78193ce890be6758a839f600144) Swipe, Plug-in, Pwned: Researchers Find New Ways to Hack
md5
54a575f7d010b9cbd0c2156a54d34c1e
ini-ai-panel-hijacking#recipe=similar-items&sourcecontentid=54a575f7d010b9cbd0c2156a54d34c1e) Bug in Google's Gemini AI Panel Opens Door to Hijacking b
md5
67c8a9b903f24a7d2a6105fe1eba82b0
linux-vms-hide-windows#recipe=similar-items&sourcecontentid=67c8a9b903f24a7d2a6105fe1eba82b0) Pro-Russian Hackers Use Linux VMs to Hide in Windows by A
Full article1,855 words · extracted from darkreading.com · click to collapse
Message-origin spoofing enables file ops on BeyondTrust Remote Support
CVE-2026-102764 is a critical (CVSS 4.0 9.3) authentication-bypass-by-spoofing flaw (CWE-290) in internal components of BeyondTrust Remote Support. Those components do not adequately check the origin of messages they receive, so a remote attacker can, under the right conditions, send spoofed messages over the network with no privileges and no user interaction. Successful exploitation can allow file operations on the appliance, with high impact to confidentiality, integrity, and availability of the vulnerable system and no stated impact on other systems. The provided data identifies BeyondTrust Remote Support but does not name affected version ranges. No public proof of concept is known and the CVE is not listed in CISA KEV; a related headline refers to “ARMORY CASTLE” exploiting BeyondTrust, but that report is not confirmed by the structured advisory data.
Do: Keep BeyondTrust Remote Support appliances off untrusted networks and allow management and support traffic only from trusted sources. Apply the vendor patch or hotfix for this issue as soon as BeyondTrust publishes it for your build, and review appliance logs for unexpected file operations or messages from untrusted origins. No fixed version is named in the provided data, so confirm the corrected release directly with BeyondTrust.
A week chock full of new high-severity and actively exploited edge vulnerabilities continues with a Chinese cyberattack built around a critical flaw in BeyondTrust Remote Support appliances.
This week, Ivanti, Cisco, Palo Alto Networks all disclosed major, already abused vulnerabilities in their core edge technologies. Might as well throw one more on the pile, then. According to a BeyondTrust blog post, the China-nexus threat actor tracked by Mandiant as "Armory Castle" (formerly UNC5221, aka UTA0178) exploited a critical BeyondTrust Remote Support vulnerability as a zero-day starting on Aug. 29, 2026. The critical vulnerability, tracked as CVE-2026-102764, earned a 9.3 CVSS score and is derived from an internal messaging component that didn't properly validate the origin of incoming messages.
It doesn't get much more serious than a critical bug in a remote access tool. IT teams use Remote Support to connect to and control computers and servers at a distance, and by exploiting it, attackers were able to do more or less the same.
Dark Reading reached out to BeyondTrust for comment on this story.
China vs. Edge Bugs: The Same Old Story
Remote Support is a common enough enterprise IT solution. BeyondTrust claims to serve more than 20,000 customers, including 75 of the Fortune 100.
L o a d i n g...
Exactly how many of those customers use Remote Support specifically is unclear. The best estimate might have been made earlier this year, when an AI agent uncovered a 9.9 CVSS-rated pre-authentication flaw in Remote Support and its companion product, Privileged Remote Access (PRA). At the time, researchers found around 11,000 Remote Support instances exposed to the Internet, across the cloud and on-premises.
This time around, attackers got to the bug before any blue team agents did. The exploitation was characterized by speed, in fact, as Armory Castle deployed its new custom PHP Webshell "SAWFLY" just 11 minutes after weaponizing the vulnerability.
Then the cyber-espionage actor got to business. According to a a report from Mandiant and Google's Threat Intelligence Group (GTIG), Armory Castle shot straight for the appliance's built-in secrets management database, systematically searching for passwords, application programming interface (API) keys, and endpoint credentials, before dumping all admin credentials. c
It established persistence with a script, combatted forensic analysts by deleting system, Web server, and application logs, and escalated from a standard service account to full admin privileges. That allowed it to launch remote sessions with downstream systems, perform internal network reconnaissance, and download and exfiltrate sensitive internal documents from victims' desktops. It also debuted a second, new custom tool, "BARECLAW," for SOCKS5 tunnelling.
It was able to do all that thanks to what Mandiant considered a "deep understanding" of BeyondTrust's technical innards.
BeyondTrust made a CVE-2026-102764 patch available on Oct. 9 and implored organizations with on-prem Remote Support to update as soon as possible. All customers would be well advised to hunt for evidence of exploitation, and, wherever possible, severely restrict Internet exposure for their network management tools.
Such advice is familiar — thought not always practiced — for security teams. This time around, perhaps in acknowledgement of how little cybersecurity advice is actually heeded around edge devices, Mandiant and GTIG researchers offered organizations three potential options for how to protect themselves, based on their operational needs, risk tolerance, and whether they've already found evidence of compromise.
First and foremost, researchers advised that customers patch. They also suggested isolating at-risk appliances — terminating access paths, restricting outbound traffic to vendor endpoints only, and redeploying from clean images.
Organizations can also apply compensating controls of various kinds: network restrictions, such as placing a Web Application Firewall (WAF) in front of edge appliances; credential and configuration hygiene, rotating credentials, reviewing and revoking sessions, etc.; and control plane restrictions, minimizing permissions, keeping credentials in an external vault rather than the appliance's built-in vault; along with plenty more.
A Bad Week for Network Security Vendors
Edge device bugs are like the milkman: they come pretty reliably every week (and you're going to have problems if you miss them). Even still, the past few days have producede several serious ones.
It all began on Oct. 13, when researchers from Volexity revealed that an unknown threat actor has been abusing a zero-day exploit chain in fully updated Ivanti Connect Secure (ICS) VPN appliances. The chain combined all of the worst kinds of vulnerabilities out there: authentication bypass, remote code execution (RCE), and privilege escalation. The former two, tracked together as CVE-2026-104935, earned a "high" CVSS score of 8.6 out of 10.
The next day brought CVE-2026-76519, a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco's Secure Email Gateway (SEG), which allowed remote attackers to write arbitrary files to the device's operating system. That issue earned a cool CVSS 9.8 out of 10, and was added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog the same day.
Also added to CISA's KEV catalog that same day was CVE-2026-0322, a high-severity RCE vulnerability with an 8.6 CVSS score in Palo Alto Networks's PAN-OS, the operating system underpinning all of the vendor's Firewall technology.
A day later, Mandiant and GTIG released its Armory Castle research. Separately, GreyNoise published a blog post about a threat actor it tracks as "skynox7" building a residential proxy network out of unpatched, Internet-exposed household appliances like network-attached storage (NAS) and network video recorders (NVRs).
"At this point, these types of vulnerabilities in network devices or tools that manage large portions of the IT of an organization are happening one every month or so," laments Bambenek Consulting president John Bambenek. "Enterprises need to stand up in unison and tell these companies it's time to get serious about security."
Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.
He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.
He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.
Want more Dark Reading stories in your Google search results?
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Informa TechTarget|
_Krot_Studio_Alamy.jpg?width=1400&auto=webp&quality=80&disable=upscale)
