Chinese Hackers Exploit BeyondTrust Zero-Day for Root Access

Key Takeaways

• A Chinese state-sponsored espionage group, ARMORY CASTLE, exploited a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support appliances.
• The attackers gained root access, deployed custom malware (SAWFLY webshell, BARECLAW tunneler), and established persistence.
• The vulnerability allowed unauthenticated remote file operations and affected BeyondTrust Remote Support versions up to 26.2.3.
• BeyondTrust released patch BT26-05 on October 15, 2026, with SaaS tenants patched earlier on October 9, 2026.
• Organizations are urged to apply the patch, conduct thorough investigations for compromise, and consider rebuilding from a clean image if signs of compromise are found.

Chinese Hackers Exploit BeyondTrust Zero-Day

A suspected state-backed Chinese cyber espionage entity, identified as ARMORY CASTLE (previously tracked as UNC5221), leveraged a zero-day flaw in BeyondTrust Remote Support appliances. This exploitation allowed them to achieve initial access, elevate privileges to root, and install persistent backdoors.

According to the Google Cloud Threat Intelligence Group (GTIG), this malicious activity occurred in late August 2026, prior to BeyondTrust publicly disclosing the vulnerability on October 15, 2026.

The critical flaw, designated as CVE-2026-102764, presented an opportunity for an unauthorized remote attacker to execute arbitrary file operations on the vulnerable appliance. Mandiant’s analysis further detailed how ARMORY CASTLE exploited this weakness to deploy malware, extract stored credentials, modify account permissions, and compromise systems managed through the appliance.

Given that BeyondTrust Remote Support appliances are designed to connect to internal network endpoints, a breach of such a device could significantly expand an attacker’s reach beyond the appliance itself. Analysts from Google Cloud’s Threat Intelligence Group noted that following the exploit, the attackers deployed the SAWFLY webshell and the BARECLAW tunneler, custom tools for maintaining access and facilitating lateral movement. Their report highlights the group’s sophisticated use of both the appliance’s native features and bespoke malware to deepen their intrusion. This incident mirrors other high-profile campaigns targeting edge devices, including previous attacks by Chinese state-sponsored actors against Ivanti VPNs.

Initial Access and Privilege Escalation

Mandiant uncovered evidence of the exploit within several appliance log files. The attack commenced with the adversary sending POST requests to a specific endpoint: /app_84304470%2Ephp. Approximately eleven minutes later, logs showed the creation of a PHP webshell, named mangoapi.php, within a web-root directory. While the initial file associated with the POST requests could not be recovered, mangoapi.php served as the SAWFLY webshell.

The SAWFLY webshell was designed for stealth. It specifically looked for a parameter, _c94mfe, in incoming POST requests. If this parameter was absent, the webshell would return a 404 error, making it less likely to be detected by automated scans. When the correct parameter was present, it would decode and decrypt the submitted data, execute PHP code, and then encrypt and encode the results before sending them back.

After establishing initial access, the attackers escalated privileges from the site service account to root. Mandiant observed the copying of /bin/sh to /usr/bin/dbus-authd, followed by changing the file’s owner to root and enabling the Set User ID (SUID) permission. This maneuver allowed the attackers to execute dbus-authd with root privileges, granting them full control over the appliance. This method of privilege escalation is reminiscent of other reported BeyondTrust vulnerability exploitations, though the specific vulnerabilities and campaigns differ.

Persistence, Credential Access, and Lateral Movement

With root-level access, the attackers were able to examine the appliance’s secrets store using BeyondTrust’s bt-secrets utility. Mandiant documented attempts to retrieve credentials for a service account and subsequently query the broader credential vault. The threat actors also systematically removed entries from the utility’s log files to obscure their activities. These actions are particularly concerning as Remote Support appliances often house or broker credentials for accessing other critical systems within an organization.

To ensure continued access even after reboots or configuration resets, the group created a startup script named zz-root-persist. This script added the compromised service account to a configuration template with passwordless sudo rights, then utilized a BeyondTrust utility to regenerate the active sudoers file. Mandiant also identified extensive log deletion across system, web server, and application logs, significantly hindering forensic analysis. Furthermore, the attackers modified the permissions of a compromised administrator account, elevating its access to Jump Items and teams from “No Access” to “Administrator.” Jump Items are systems configured for remote support, and with these elevated permissions, the attackers could initiate sessions to downstream devices, transfer files, and exfiltrate sensitive internal documents, such as software inventories.

For network traversal, the attackers deployed BARECLAW, a custom SOCKS5 tunneler that communicated over WebSockets. In the observed attacks, BARECLAW listened locally on TCP port 19800. The attackers configured the appliance’s HAProxy to route requests with the URI path /uidchanarge to this local tunneler. This indirect routing method, leveraging an internal proxy to reach a localhost-bound listener, aligns with common tactics used by espionage groups to establish persistent footholds on edge appliances, as seen in other zero-day campaigns against products like Ivanti VPNs.

BeyondTrust confirmed that CVE-2026-102764 impacts all supported Remote Support versions up to 26.2.3. Both Google Cloud and Mandiant strongly advise affected organizations to apply the BT26-05 patch. SaaS customers received automatic patching on October 9, 2026. Self-hosted customers must apply the BT26-05-RS patch, ensuring any older versions are upgraded to a supported release first. While patching remediates the vulnerability, it does not erase evidence of a prior compromise.

What You Should Do

• Immediately apply the BT26-05 patch to all BeyondTrust Remote Support appliances. For self-hosted instances, ensure you are on a supported version before applying the patch.
• Conduct a thorough forensic investigation of your BeyondTrust appliances for any signs of compromise, covering the entire exposure period (from late August 2026 to present).
• Preserve and meticulously review external firewall and reverse-proxy logs for suspicious activity.
• Examine your appliance’s file system for unexpected files in web-root directories (e.g., mangoapi.php), newly created SUID binaries (e.g., /usr/bin/dbus-authd), or unauthorized startup scripts (e.g., zz-root-persist).
• Check for any unauthorized modifications to sudoers files, unusual access to the bt-secrets utility, or changes to administrator account permissions (especially related to Jump Items and teams).
• If a compromise is confirmed or cannot be definitively ruled out, rebuild the affected appliance from a clean, patched image rather than relying solely on reboots or configuration resets.
• Rotate all credentials for accounts managed or accessed via the BeyondTrust appliance *only after* the appliance has been thoroughly patched or rebuilt and verified clean. Rotating credentials on a still-compromised device risks immediate re-capture by the attacker.
• Consult the detailed Google Cloud threat report and BeyondTrust’s BT26-05 advisory for comprehensive indicators of compromise and mitigation guidance.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.