Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access

A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15.

Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access, stole credentials, altered appliance permissions and created a route for tunneling into victim networks.

The product lets IT teams securely connect to and troubleshoot remote systems. Successful exploitation allows arbitrary file uploads, giving attackers an entry point on an internet-facing appliance.

BeyondTrust has published patches and guidance in its security advisory and accompanying blog.

Mandiant attributes the activity to ARMORY CASTLE, a suspected PRC-nexus espionage actor previously tracked as UNC5221.

The group’s post-exploitation activity points to detailed knowledge of BeyondTrust internal components, including its command-line utilities, configuration templates and reverse-proxy routing.

That appliance-specific expertise helped the attackers turn initial access into durable control.

After exploiting the flaw, the attackers sent POST requests to /app_84304470%2Ephp. Mandiant could not recover the file associated with those requests.

About 11 minutes later, the appliance recorded a PHP webshell called SAWFLY at a web-root path.

The lightweight, obfuscated implant uses a custom Base32 transport and RC4 encryption.

It returns a 404 response when its expected parameter is absent, reducing exposure to routine scanners; with the parameter present, it decrypts and executes supplied PHP code.

SAWFLY ran as an unprivileged site service account. To elevate privileges, the attackers copied /bin/sh to /usr/bin/dbus-authd, changed the copy’s owner to root and enabled the Set User ID (SUID) bit.

The resulting executable ran with root privileges, providing a direct route to control of the appliance.

Google Cloud Researchers said that, the vulnerability, tracked as CVE-2026-102764, affects BeyondTrust Remote Support appliances, formerly known as Bomgar.

BeyondTrust Zero-Day Exploited

The attackers also targeted BeyondTrust’s native secrets-management utility, /ns/sbin/bt-secrets, trying multiple command forms to retrieve credentials from a site-specific vault and the appliance-wide password safe.

They then deleted the utility’s log and archived records.

For persistence across reboots and configuration resets, they planted a startup script that added passwordless root privileges for the service account to a sudoers template and invoked BeyondTrust’s system-configuration utility to apply the change.

Mandiant observed the attackers deleting authentication, web, application and system logs. They also used compromised administrator credentials to enter the Remote Support portal and change account permissions.

By upgrading the account’s Jump Item and team roles from “No Access” to “Administrator,” they enabled remote sessions to systems listed in the appliance.

The attackers then used those sessions to inspect internal endpoints and transfer files, including software inventories.

A custom C-based tool, BARECLAW, provided another route into the network: it relayed TCP connections through a SOCKS5 proxy access over WebSockets.

In the observed configuration, it listened on port 19800, used a token and obfuscation, and suppressed its own logs.

The attackers modified HAProxy rules to route requests for a chosen URL path to the local BARECLAW listener, making the service reachable through the appliance’s existing proxy.

Organizations using affected BeyondTrust Remote Support appliances should apply BeyondTrust’s patches immediately and follow the vendor’s remediation guidance.

Because the intrusion involved root access, credential-vault access, log deletion and persistence changes, patching alone may not resolve a prior compromise.

Review appliance and network telemetry for unexpected web-root files, SUID binaries, changes to startup scripts or sudoers templates, altered HAProxy configuration, suspicious bt-secrets activity, unexpected administrator permission changes, and outbound WebSocket traffic.

GTIG warns that ARMORY CASTLE and other actors have previously shifted from selective zero-day exploitation to broader opportunistic attacks after vulnerabilities became public.

Mandiant has documented a similar pattern in earlier campaigns against edge devices, including Ivanti appliances, where attackers deployed custom webshells and tunnelers and attempted to erase evidence.

Mandiant’s reporting on UNC5221’s Ivanti activity provides relevant context: internet-facing appliances can become both a foothold and a concealed bridge into an organization’s internal systems.

Indicators of Compromise 

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.