malware-log.hatenablog.com • 3h
BeyondTrust Remote Support Zero-Day Exploited by ARMORY CASTLE
In late August 2026, the China‑nexus espionage group ARMORY CASTLE (UNC5221/WARP PANDA) exploited CVE‑2026-102764, an improper origin validation flaw in BeyondTrust Remote Support’s internal messaging component, enabling unauthenticated remote file operations. The attackers deployed a PHP web shell (SAWFLY), created a SUID‑root copy of /bin/sh, injected a passwordless sudo entry for persistence, attempted to dump the credential vault via bt‑secrets, wiped logs, and established covert channels using BARECLAW SOCKS5 tunneler and HAProxy redirection. BeyondTrust released patch BT26-05‑RS on 8 Oct 2026 (self‑hosted) and auto‑patched SaaS instances by 9 Oct 2026, urging immediate application and credential rotation only after verification.