BeyondTrust Remote Support Zero-Day Exploited by ARMORY CASTLE

In late August 2026, the China‑nexus espionage group ARMORY CASTLE (UNC5221/WARP PANDA) exploited CVE‑2026-102764, an improper origin validation flaw in BeyondTrust Remote Support’s internal messaging component, enabling unauthenticated remote file operations. The attackers deployed a PHP web shell (SAWFLY), created a SUID‑root copy of /bin/sh, injected a passwordless sudo entry for persistence, attempted to dump the credential vault via bt‑secrets, wiped logs, and established covert channels using BARECLAW SOCKS5 tunneler and HAProxy redirection. BeyondTrust released patch BT26-05‑RS on 8 Oct 2026 (self‑hosted) and auto‑patched SaaS instances by 9 Oct 2026, urging immediate application and credential rotation only after verification.

• Vulnerability Mechanics

  • CVE‑2026-102764 (CVSS 9.3) stems from missing origin checks in an internal messaging API, allowing unauthenticated file write/delete.
  • Affected versions: BeyondTrust Remote Support ≤ 26.2.3 (self‑hosted).
  • Exploitation vector: unauthenticated POST to the messaging endpoint leading to arbitrary file placement in the web root.

• Exploitation & Payloads

  • Initial compromise: placement of PHP web shell SAWFLY in the appliance’s web directory.
  • Privilege escalation: copy of /bin/sh to /usr/bin/dbus-authd, chown root, set SUID bit for root shell.
  • Persistence: startup script writes a passwordless sudo entry for www-data (or similar) into the sudoers template.
  • Credential access: execution of bt‑secrets CLI to attempt dumping of the BeyondTrust credential vault.
  • Covert channels: deployment of BARECLAW custom SOCKS5 tunneler; HAProxy reconfigured to forward traffic to a local high‑port listener tied to BARECLAW.

• Impact & Indicators of Compromise

  • Full control of the Remote Support appliance, enabling extraction of brokered/stored credentials and lateral movement via Jump Item lists.
  • IoCs: atypical SUID root file /usr/bin/dbus-authd; presence of SAWFLY.php in web root; sudoers template with passwordless entry; BARECLAW binary or unexpected SOCKS5 listener; HAProxy config with hidden backend to localhost:high‑port; unexplained Jump Item/Team permission changes; missing/truncated logs in /var/log, /var/log/apache2, /var/log/bt*.
  • Exploitation window: first observed 29 Aug 2026, undetected until 28 Sep 2026.

• Detection, Mitigation & Remediation

  • Apply BeyondTrust patch BT26-05‑RS immediately on all self‑hosted RS appliances ≥ 24.3.1; older versions require upgrade first.
  • Rotate all credentials stored or brokered by the appliance only after confirming patch integrity and appliance cleanliness.
  • Snapshot suspect appliances before any reboot; rebuild from clean image if compromise is indicated.
  • Audit HAProxy configurations, sudoers templates, and /usr/bin/dbus-authd for unauthorized modifications.
  • Monitor for outbound SOCKS5 traffic on unusual ports and for PHP web shell requests in web logs.