China-Nexus Actor Exploited BeyondTrust Remote Support Zero-Day
Summary
A China-nexus actor exploited CVE-2026-102764 in BeyondTrust Remote Support from Aug. 29, deploying a webshell and stealing credentials and documents. BeyondTrust released a patch on Oct. 9.
Key points
- The critical vulnerability, rated 9.3 CVSS, involved an internal messaging component that failed to validate the origin of incoming messages.
- Mandiant and Google Threat Intelligence Group attributed the exploitation to Armory Castle, formerly tracked as UNC5221 and also known as UTA0178.
- The actor deployed the SAWFLY PHP webshell 11 minutes after weaponizing the vulnerability.
- Attackers searched the appliance's secrets database for passwords, API keys, and endpoint credentials, then dumped administrator credentials.
- The attackers established persistence, deleted logs, escalated privileges, accessed downstream systems, and exfiltrated sensitive internal documents.
- A second custom tool, BARECLAW, was used for SOCKS5 tunneling.
- BeyondTrust released a patch on Oct. 9; guidance included patching, restricting exposure, and hunting for signs of exploitation.
Article Details
- Vulnerability Types
- Improper validation of the origin of incoming messages in an internal messaging component
- Severity
- Critical; CVSS 9.3
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict Internet exposure for network management tools.
- Isolate at-risk appliances by terminating access paths and restricting outbound traffic to vendor endpoints only.
- Place a Web Application Firewall in front of edge appliances.
- Rotate credentials, review and revoke sessions, minimize permissions, and keep credentials in an external vault rather than the appliance's built-in vault.
MITRE ATT&CK
T1021 · Remote ServicesThe actor launched remote sessions with downstream systems.T1041 · Exfiltration Over C2 ChannelThe actor downloaded and exfiltrated sensitive internal documents from victims' desktops.T1046 · Network Service DiscoveryThe actor performed internal network reconnaissance.T1070.002 · Clear Linux or Mac System LogsThe actor deleted system, Web server, and application logs to hinder forensic analysis.T1090.003 · Multi-hop ProxyThe custom tool BARECLAW was used for SOCKS5 tunnelling.T1098 · Account ManipulationThe actor escalated privileges from a standard service account to full administrator privileges.T1505.003 · Web ShellArmory Castle deployed the custom PHP webshell SAWFLY on the exploited BeyondTrust appliance.