Acyber espionage collective linked to China — known as Armory Castle (previously UNC5221 or Warp Panda) — recently leveraged a critical zero-day in BeyondTrust Remote Support to deploy two pieces of malware, SAWFLY and BARECLAW, according to new disclosures.
The vulnerability, CVE-2026-102764, affects internal messaging components of Remote Support appliances. At a critical severity of 9.3, the flaw permits remote attackers to perform file operations on the appliance because messages are accepted without properly verifying their origins.
Patches have been released: SaaS users as of October 9, 2026, received automatic updates. Self-hosted versions running between 24.3.1 to 26.2.3 must apply the BT26-05-RS patch manually; versions older than 24.3.1 must update to a newer base version to patch.
Timeline & Attack Flow
On August 29, 2026, Armory Castle exploited the vulnerability on a self-hosted Remote Support appliance. Public reports of similar activity involving another security device provider surfaced on September 27, triggering investigations and reviews of other systems for related attacks.
Following successful breach, the actor installs SAWFLY, a PHP web shell for remote interaction and encrypted command-and-control communication, using compromised VPN exit nodes and hijacked home or small-office routers to mask its activities. Privilege escalation follows: root control is obtained via manipulation of system shell binaries, exploitation of configuration templates, and abusing CLI utilities to access stored secrets and administrative credentials.
Post-Exploitation & Malware Details
After infiltrating the BeyondTrust appliance, the actor leverages several capabilities: harvesting of credentials, cracking root access to site service accounts, remote sessions to downstream systems listed in BeyondTrust’s Jump Item list, and exfiltration of sensitive files.
BARECLAW, a custom C-based SOCKS5 proxy tunneler, is used to relay TCP traffic between a remote client and internal systems. To make this proxy accessible, attackers modify the HAProxy configuration file (“/ns/config/haproxy.conf”) so that BARECLAW can receive connections directly from the internet. Efforts to cover tracks include deleting system, server, and application logs systematically.
Investigators point out that this level of intrusion shows deep knowledge of the appliance internals — from proprietary configuration templates to built-in utilities. For any Remote Support appliance exposed to the internet and using vulnerable software versions during the exploitation period, cybersecurity teams are urged to assume possible compromise until a thorough review confirms otherwise.
Armory Castle has history: zero-days in Citrix NetScaler and Ivanti Connect Secure have been used in previous campaigns against sectors like government, legal, and enterprise services for long-term intelligence collection. The group is known to target high-value software beforehand, keeping detailed product models to streamline future exploit development.
Remediation & Recommendations
BeyondTrust users should verify deployment of October 9 patches for SaaS hosts. Self-hosted setups need to upgrade and apply BT26-05-RS if in affected version ranges. Older versions must upgrade to a version capable of receiving the patch.
Organizations should conduct forensic reviews: check for web shells, unauthorized configuration modifications, suspicious proxy activity, credential theft, and presence of malware. Isolate exposed appliances and validate integrity of stored binaries and templates.
Implement monitoring for external access to HAProxy configs and any new SOCKS5 services. Keep logging mechanisms protected and regularly review for signs of tampering.
Though this attack shows Armory Castle’s evolving sophistication — combining zero-days with advanced C2 tools and proxy techniques — it underscores a larger trend: state-linked adversaries gaining advanced, persistent access via infrastructure tools meant to aid support. As beyondpatching, security teams must assume breach, prioritize internal visibility, and defend at the appliance level. What happens next: watch for broader scans targeting unpatched Remote Support instances, potential variants of SAWFLY or BARECLAW, and how defenders adapt both detection and response strategies.
