Google warns of China-linked hack on BeyondTrust appliances

Google's Mandiant unit said a suspected China-linked espionage group exploited a zero-day flaw in BeyondTrust Remote Support appliances. It linked the activity to a threat actor it tracks as ARMORY CASTLE.

The flaw, tracked as CVE-2026-102764, affects supported BeyondTrust Remote Support versions up to 26.2.3 and can allow an unauthenticated attacker to upload files to a device.

Mandiant found evidence the vulnerability was used as a zero-day in late August, before public disclosure. The intruder then used a series of post-exploitation steps to gain root access, harvest credentials, maintain persistence and move deeper into victim networks.

BeyondTrust Remote Support, previously known as Bomgar, is used by information technology teams to access and troubleshoot remote systems. A compromise of the appliance itself is particularly serious because it can expose stored credentials and provide a route into other internal machines.

How The Intrusion Worked

The attacker first staged a webshell after exploiting the flaw. Roughly 11 minutes after the initial suspicious POST requests, investigators observed the creation of a PHP-based webshell known as SAWFLY in the web root path.

The webshell was designed to evade routine scanning by returning a 404 error when a specific parameter was absent. When activated with the right request, it decoded and decrypted a payload, then executed PHP code on the appliance.

The attacker then escalated privileges. The webshell initially ran under an unprivileged site service account, but the intruder copied the system shell, changed its ownership to root and enabled SUID permissions, creating what researchers described as a persistent root-level backdoor.

That access opened the way to the appliance's stored secrets. Investigators said the attacker used BeyondTrust's own administrative utility, bt-secrets, in several command variations in an apparent attempt to dump credential vault contents, including passwords, keys and other stored secrets.

The attacker also deleted bt-secrets log records and other appliance logs during the intrusion. The report described repeated efforts to remove system, web server and application logs in what it characterised as anti-forensic behaviour.

Persistence And Pivoting

To preserve access, the attacker targeted BeyondTrust configuration templates rather than relying on temporary host changes. The intruder created a startup script in a post-boot directory so a site service account would retain passwordless root privileges even after a reboot or configuration reset.

The actor also pivoted into the BeyondTrust administrative portal using compromised administrator credentials. Once inside, the attacker changed permissions on an account, raising access to Jump Items and teams from "No Access" to "Administrator".

Those changes effectively gave the intruder ongoing authority to launch remote sessions to downstream systems listed on the appliance. The attacker then used built-in support tools and file transfer features to conduct reconnaissance and remove sensitive internal documents from an endpoint desktop.

Investigators also identified a custom tunnelling tool known as BARECLAW. Mandiant said the malware provided a SOCKS5 proxy over WebSocket and was configured to listen on a local port while remaining hidden from external scans.

To expose that tunnel externally, the attacker modified the appliance's HAProxy configuration. Those changes routed requests for a specific path to the locally bound BARECLAW service, creating an internet-reachable access path that blended into the appliance's existing traffic handling.

Attribution And Risk

Google Threat Intelligence Group attributed the exploitation and deployment of SAWFLY and BARECLAW to ARMORY CASTLE, formerly tracked as UNC5221. It said the tooling and methods matched earlier activity linked to the same actor, including campaigns targeting edge appliances.

Mandiant warned organisations to prepare for broader opportunistic exploitation now that the flaw is public. It said the actor has previously shifted from selective zero-day use to wider exploitation after vulnerabilities became known.

Researchers urged affected organisations to apply BeyondTrust's BT26-05 patch and assess whether internet-facing appliances were exposed during the relevant window. They added that any vulnerable appliance reachable from the internet should be treated as potentially compromised until it has been reviewed.

Mandiant recommended a patch-first approach, along with forensic preservation of virtual appliances, collection of external logs and credential rotation only after systems have been patched or rebuilt. It also called for tighter controls on administrative access, session handling, API accounts and outbound traffic from the appliances.

"Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed," Mandiant said.