ARMORY CASTLE used BeyondTrust as a zero-day. Rebuild the appliance.

CVE-2026-102764 is unauthenticated file operations on Remote Support. SaaS is patched. Self-hosted still has to hunt. Mandiant says treat internet-reachable boxes as compromised until reviewed.

RWP Ventures · 2026-10-16 · event 2026-10-15 · 14 min read · priority 9.2

Do not collapse four facts.

1. SaaS is not the self-hosted ticket. BeyondTrust applied the patch to all Remote Support SaaS tenants on 8–9 October. Cloud tenants still rotate credentials and review sessions. Self-hosted Remote Support 24.3.1 through 26.2.3 must apply BT26-05-RS. Anything older than 24.3.1 has to upgrade first. Privileged Remote Access shares the code; BeyondTrust has not confirmed a working exploit on PRA and patched it anyway.
2. The patch does not clean the vault. Remote Support stores and brokers privileged credentials. Mandiant recovered bt-secrets vault dumps, a SUID root shell at /usr/bin/dbus-authd, a reboot-surviving zz-root-persist sudoers rewrite, Jump Item roles raised to Administrator, and a custom SOCKS5 tunneler (BARECLAW) fronted through HAProxy. Host-level persistence survives reboot and configuration reset. Mandiant’s sentence: rebuild, do not clean.
3. Two confirmed boxes is not a census. BeyondTrust: one BeyondTrust-hosted Remote Support instance and one self-hosted appliance on 29 August. Mandiant’s IR is the self-hosted case. Victim count beyond those two is UNKNOWN. Mandiant assesses, with the actor’s prior Ivanti and NetScaler pattern, that public disclosure is the start of opportunistic scanning, not the end of the selective window.
4. This is not on KEV this morning. Catalog freeze is 2026.10.15 / 1746. The one new row overnight is [CVE-2026-21589](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/) (Atlassian Data Center file read, due 18 October, forensicTriage: Yes). 102764 is a separate product. Do not wait for a KEV row to hunt a remote-support appliance that has been internet-reachable since August.

The operator sentence: inventory every Remote Support appliance tonight, apply BT26-05, then treat any internet-reachable box in the window as a hunt — not a patch ticket.

What happened

BeyondTrust’s 15 October advisory is the public CVE for a bug the company reproduced on 28 September after a hunt, and patched into SaaS and self-hosted trains on 8 October. Mandiant is publishing the intrusion because it had the self-hosted victim. Coordinated disclosure, not a new patch train.

ARMORY CASTLE’s entry, per Mandiant, is CVE-2026-102764. Successful use is an arbitrary file upload onto the appliance. About eleven minutes after a POST to a staging PHP path, Mandiant saw SAWFLY (mangoapi.php) land in the site service account’s Laravel public web root. SAWFLY is a small PHP webshell: missing parameter _c94mfe returns HTTP 404; present, it Base32-decodes, RC4-decrypts, and evals. From that unprivileged site user the operator copied /bin/sh to /usr/bin/dbus-authd, set owner root and the SUID bit, and had a persistent root shell.

Root on this product is the credential plane. Mandiant recovered attempts to dump the appliance vault through the native /ns/sbin/bt-secrets CLI, then deletion of bt-secrets.log. Persistence that survives a config reset went into /home/bomgar/sbin/post_boot.d/zz-root-persist, which appends passwordless sudo for the site account to /ns/config/sudoers.template and runs bt-sysconfig. The operator then logged into /login as an administrator, raised Jump Item and team roles from No Access to Administrator, opened support sessions to downstream endpoints, and pulled files. Egress was BARECLAW, a C SOCKS5/WebSocket tunneler listening on 19800 at path /uidchanarge, with HAProxy rewritten so that path never hits the real web stack.

BeyondTrust is withholding the vulnerability mechanics while self-hosted appliances are still being patched. That is a vendor choice, not a gap this article will fill. CWE-290 and “improper origin validation in an internal messaging component” is the public class.

The Hacker News and BleepingComputer independently relay the same coordinated packet on 16 October. BleepingComputer, citing Shadowserver, reports more than 1,400 BeyondTrust Remote Support / Privileged Remote Access instances on the internet. That is a census of exposure, not a victim count, and Shadowserver does not say how many are patched or honeypots.

Why it matters

Remote Support sits on the help-desk path. It holds Jump Items, vaulted credentials, API secrets, and a map of who can reach what. An unauthenticated file-write that becomes root is not a help-desk inconvenience. It is a credential-broker compromise with a built-in remote-access channel to the rest of the estate.

The second reason is the actor’s pattern. Mandiant and GTIG have previously tied UNC5221 / ARMORY CASTLE to zero-day use against Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282). The documented method is selective zero-day against chosen targets, then broad opportunistic scanning the day the CVE is public. Mandiant writes that pattern as the outlook for 102764. Treat 15 October as the start of the mass-scan window, not as the first day the bug existed.

The third reason is anti-forensics on a locked-down appliance. Customers cannot audit the host file system the way they would a Linux VM they own. The actor deleted auth, SSL, HTTP, PHP, and messages logs from the SAWFLY context. Evidence that only lived on the box is gone. Off-box syslog, reverse-proxy URI logs, and perimeter firewalls are the record. Mandiant’s IR artifacts were on a LUKS-encrypted /home partition. A green /appliance dashboard after BT26-05 is not a clean bill.

This is not confirmed OT process impact. A Remote Support appliance used by a plant, a water utility, or a hospital is still an IT compromise of a support broker at an industrial or clinical organization. Do not write a process event. Do not merge it with [Wednesday’s Connect Secure / UTA0576 chain](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/) or [yesterday’s Secure Email Gateway 76519](/posts/2026-10-15-cisco-seg-cve-2026-76519-amp/). Same class of edge box. Separate CVEs, separate actors on the public record.

Who / what is affected

Technical context

RWP is not reproducing the exploit. BeyondTrust is not publishing the trigger. Defenders need the class and the post-exploitation residue.

CVE-2026-102764 is CWE-290 (authentication bypass by spoofing) via improper origin validation on an internal messaging component. Vendor CVSS 4.0 9.3 CRITICAL. Unauthenticated, no user interaction. Impact is file operations on the appliance, which in the Mandiant case became a webshell, then root, then the vault.

Hunt without treating the CLI as an exploit. Prefer off-box logs. If you have a forensic image or vendor-assisted collection:

Mandiant published YARA for SAWFLY (G_Hunting_Webshell_SAWFLY_1) and BARECLAW (G_Hunting_Backdoor_BARECLAW_1), plus a VirusTotal GTI collection. Use those. Do not wait for a scanner signature that keys on the withheld origin-validation trigger.

ATT&CK mapping for the ticket — public reporting, not a playbook:

Threat / exploitation status

Confidence on the CVE identity, the BT26-05 patch trains, Mandiant’s post-exploitation artifacts, and two confirmed compromised appliances: high. Confidence on ARMORY CASTLE as the operator of those two boxes: high (vendor + Mandiant, tradecraft-based; BeyondTrust says moderate-to-high). Confidence that every internet-reachable Remote Support box in August–October is compromised: low — two named, no census. Confidence that opportunistic scanning begins with disclosure: moderate, based on this actor’s documented Ivanti/NetScaler follow-through, not on a 16 October scan table in this retrieval.

What defenders should do

1. Inventory every Remote Support and Privileged Remote Access instance — SaaS, B Series, virtual, auto-update on or off. Record version. Record whether /appliance shows BT26-05-RS. Record internet exposure of /login and /appliance versus representative-console / Jump Client paths. Snapshot the strings before you change anything.
2. Close 102764 on an emergency window. SaaS: the appliance patch is done; still do credential and session review. Self-hosted 24.3.1+: BT26-05-RS from /appliance, or confirm auto-update applied it. Older than 24.3.1: upgrade to a supported train, then patch. If the patch is not visible, open a BeyondTrust case and cite BT26-05. PRA self-hosted: patch anyway.
3. Treat internet-reachable appliances in the window as potentially compromised until reviewed. That is Mandiant’s sentence, not ours. Off-box logs first — syslog, reverse-proxy/WAF URIs, perimeter firewall. On-box logs were deleted in the IR case. Preserve: snapshot virtual appliances with memory before reboot; B Series / SaaS, ask BeyondTrust Support for forensic preservation.
4. If compromise is plausible, do not patch in place and hope. Mandiant: customers cannot audit the host file system; host persistence survives reboot and config reset. Redeploy from a clean, fully patched image. Restore only a configuration backup from before the exposure window, or restore isolated and finish the review before reconnecting. New TLS certificate. Redeploy Jump Clients, Jumpoints, and the representative console from the rebuilt appliance.
5. Rotate after the box is patched or rebuilt, not before. Order Mandiant published: /appliance admins; /login users; API client secrets; IdP bind accounts and SAML signing keys; Remote Support Vault / Password Safe / PRA credentials at the target system; SMTP / syslog / ITSM connectors; anything typed into a support session during the window. Review user_changed Jump Item roles, API accounts, security providers, and outbound event destinations against a pre-window baseline. Every endpoint that took a support session in the window is downstream hunt scope.
6. Keep the other clocks. CVE-2026-104935 (Ivanti Connect Secure) is due today, 16 October, forensic triage Yes — [14 October Daily Top](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/). CVE-2026-96951 (Windows MotW) shares that due. CVE-2026-76519 (Cisco SEG) and CVE-2026-0322 (PAN-OS) are due tomorrow. CVE-2026-21589 (Atlassian, already [Daily Top 6 October](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/)) landed on KEV yesterday, due 18 October, forensic triage Yes. Do not steal Remote Support owners for a Jira ticket. Do not skip the Atlassian hunt because this article is about BeyondTrust.

RWP assessment

Score 9.2.

Highest-leverage development since yesterday’s Cisco SEG 76519 write-up is a coordinated vendor + Mandiant disclosure of a Remote Support zero-day used since 29 August by ARMORY CASTLE, with IR-grade post-exploitation, a vault on the box, and self-hosted appliances still in the window Mandiant says historically goes broad the day the CVE is public. Evidence quality is high on BeyondTrust BT26-05, the CVE record, and Mandiant/GTIG. Evidence quality is intentionally split on victim count (two confirmed, no census), on whether opportunistic scanning has already started overnight, and on PRA exploitability (shared code, no confirmed trigger).

It outranks the Atlassian CVE-2026-21589 KEV add because that bug was already [Daily Top 6 October](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/). Yesterday’s catalog row (2026.10.15 / 1746, due 18 October, forensic triage Yes) is a material increment — CCCS AV26-1002 Update 2, watchTowr, Previdian, CrowdSec — not a new product, and it is a known-path file read, not host root on a credential broker. It outranks Eclipse Milo ICSA-26-288-01 (CISA ICS, 15 October, CVSS 4.0 up to 9.1, no claimed exploitation, not KEV). It outranks a second day on Ivanti 104935 and Windows 96951 because those dues are today with no overnight vendor increment in this retrieval. It outranks yesterday’s Cisco 76519 because that story is already on the site; the new public IR is BeyondTrust.

What we are not saying: that every internet Remote Support box is confirmed compromised; that PRA is confirmed exploitable; that 102764 is on KEV; that ransomware is Known; that this is OT process impact; that ARMORY CASTLE is confirmed as a PRC Ministry attribution rather than a GTIG/Mandiant cluster with suspected PRC nexus.

What we are watching

• Whether CISA puts CVE-2026-102764 on KEV, and whether forensicTriage is Yes.
• Extra-Mandiant victim telemetry and scan tables in the 72 hours after disclosure.
• Whether BeyondTrust confirms a working PRA trigger, or names more than the two August boxes.
• Whether knownRansomwareCampaignUse appears if a KEV row lands.
• SAWFLY / BARECLAW reuse against other edge appliances.
• Parallel clocks: Ivanti 104935 and Windows 96951 due today; Cisco 76519 and PAN-OS 0322 due 17 October; Atlassian 21589 due 18 October.
• Catalog freeze is now 2026.10.15 / 1746. Yesterday’s freeze was 2026.10.14 / 1745.

Sources

• BeyondTrust — BT26-05
• BeyondTrust — ARMORY CASTLE and BT26-05, 15 October 2026
• Mandiant / Google Threat Intelligence — ARMORY CASTLE Exploits BeyondTrust, 15 October 2026
• CVE.org — CVE-2026-102764
• The Hacker News — China-Linked Hackers Exploited BeyondTrust Zero-Day, 16 October 2026
• BleepingComputer — BeyondTrust patches zero-day exploited in attacks since August, 16 October 2026
• CISA — one KEV addition, 15 October 2026
• CISA KEV JSON catalog 2026.10.15
• CISA KEV — CVE-2026-21589
• CISA — Eclipse Milo, ICSA-26-288-01
• Atlassian — CVE-2026-21589
• Canadian Centre for Cyber Security — AV26-1002 Update 2
• [RWP — Ivanti CVE-2026-104935, 14 October 2026](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/)
• [RWP — Cisco SEG CVE-2026-76519, 15 October 2026](/posts/2026-10-15-cisco-seg-cve-2026-76519-amp/)
• [RWP — Atlassian CVE-2026-21589, 6 October 2026](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/)