TL;DR

CVE-2026-102764 is a critical (CVSS 9.3) origin-validation flaw in BeyondTrust Remote Support (formerly Bomgar) that lets an unauthenticated remote attacker perform arbitrary file operations on the appliance. ARMORY CASTLE — the China-nexus espionage actor Google Threat Intelligence Group tracks as UNC5221 — exploited it as a zero-day on August 29, 2026, and deployed two newly-identified tools: the SAWFLY PHP webshell and the BARECLAW SOCKS5-over-WebSocket tunneler. BeyondTrust published the patch on October 8 and disclosed it alongside Mandiant on October 15.

The Flaw

The vulnerability lives in Remote Support’s internal messaging component. The component receives messages from other services on the appliance but doesn’t adequately validate the origin of each message. Under the right conditions, an attacker can forge a message that tricks the component into writing files anywhere the service account can reach.

CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The key detail: this isn’t a straight RCE. It’s a file-opener. But on a BeyondTrust appliance, “arbitrary file operations” means you can drop a webshell into the web root, modify configuration templates, or overwrite binary files — which is effectively host-level control.

ARMORY CASTLE’s Attack Chain

Here’s what Mandiant reconstructed from a compromised self-hosted appliance:

August 29: The attacker exploits CVE-2026-102764 against a single self-hosted Remote Support instance. They drop a PHP staging webshell (app_84304470.php) in the web directory.

Post-exploitation: They escalate to passwordless root on the site service account by targeting BeyondTrust’s configuration templates — a deep understanding of appliance internals that suggests prior reconnaissance.

Credential harvest: The attacker locates BeyondTrust’s internal secrets management database and extracts every stored credential: jump items, endpoint accounts, session keys.

Lateral movement: They launch remote sessions to downstream systems from the appliance’s Jump Item list, using the harvested credentials.

The backdoors: Two custom tools, never seen before in the wild:

  • SAWFLY — a PHP webshell with encrypted C2 communication. It’s what the attacker uses to issue commands from the BeyondTrust appliance.
  • BARECLAW — a C-based SOCKS5-over-WebSocket tunneler. It embeds CivetWeb for HTTP/WebSocket handling and OpenSSL for optional TLS. The attacker configures it to listen on TCP port 19800, with XOR-obfuscated encryption derived from a shared token, and routes it through HAProxy by modifying /ns/config/haproxy.conf. The tunnel endpoint (/uidchanarge) is completely hidden from external port scans — only HAProxy’s internal routing can reach it.

Log wiping: ARMORY CASTLE systematically deletes system, web server, and application-level logs. Off-box syslog is often the only record left.

The Timeline

  • Aug 29: Zero-day exploitation on a single self-hosted appliance and one SaaS instance
  • Sep 27: A separate zero-day campaign against another edge- appliance vendor goes public — triggers a hunt
  • Sep 28: BeyondTrust’s threat hunting surfaces the affected SaaS instance. Contained in 27 minutes.
  • Sep 30: Product Security reproduces the entry vector in a lab; Engineering starts building the fix
  • Oct 8: BT26-05 patch ships to SaaS (auto-applied) and self-hosted customers
  • Oct 15: BT26-05 and Mandiant’s full analysis published

The five-week window between zero-day exploitation and public disclosure is long, but the containment was aggressive — 27 minutes from detection to isolation on the SaaS side.

What to Look For

If your BeyondTrust appliance was internet-facing on a vulnerable version (anything ≤ 26.2.3) during the exploitation window:

  1. Check for mangoapi.php (SHA-256: dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb) in the web directory
  2. Check for ingredi_ws (SHA-256: 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462) — the BARECLAW binary
  3. Check /ns/config/haproxy.conf for a webskd3 backend and wswsws ACL routing to a local port 19800 listener
  4. Look for unrecognized privileged sessions from residential broadband or commercial VPNs
  5. Check syslog for gaps that start and end within a single session window
  6. Rotate every credential the appliance stores

The Actor

ARMORY CASTLE has a history of exploiting zero-days in edge appliances: Citrix NetScaler (CVE-2023-4966), Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282). They rotate infrastructure and tooling for every victim. Their targeting includes legal services, SaaS providers, business-process outsourcers, technology companies, and government.

Mandiant expects broad exploitation of CVE-2026-102764 to follow the public disclosure, just as ARMORY CASTLE has done with every previous zero-day they’ve deployed.

The Takeaway

This is another reminder that edge-appliance vendors are the favorite entry point for nation-state espionage actors. The attack chain is always the same: zero-day in the appliance → file operations → webshell → credential harvest → lateral movement. What makes ARMORY CASTLE notable is the depth of their appliance knowledge — they don’t just drop a shell and wait. They modify HAProxy configs, abuse proprietary CLI utilities, and embed SOCKS5 tunnellers in the appliance’s own reverse-proxy chain.

Every self-hosted BeyondTrust Remote Support appliance on a version ≤ 26.2.3 should be treated as potentially compromised until reviewed. The patch exists. It’s been available for nine days as of publication.