ARMORY CASTLE Exploits BeyondTrust Remote Support Zero-Day for Espionage

Mandiant reported that ARMORY CASTLE, a suspected China-linked espionage actor formerly tracked as UNC5221, exploited an arbitrary file-upload vulnerability in BeyondTrust Remote Support appliances as a zero-day in late August 2026. BeyondTrust disclosed the flaw, CVE-2026-102764, on October 15. During an incident response engagement, Mandiant found that the attacker used appliance-specific utilities and configuration changes to escalate privileges, establish persistence, and enable lateral movement, deploying the newly identified SAWFLY webshell and BARECLAW tunneler.

The intrusion involved changes to privileged access and reverse-proxy routing, alongside extensive log deletion to evade detection. Mandiant urged organizations to apply BeyondTrust patches immediately, warning that public disclosure could lead to widespread exploitation. Defenders should also investigate affected appliances for unauthorized privileged-access changes, altered proxy configurations, evidence of log deletion, and the reported malware; patching alone does not remove an existing compromise.