China-nexus Armory Castle (also tracked as UNC5221 and Warp Panda) exploited a critical zero-day in BeyondTrust Remote Support from August 29 through at least early October 2026. Mandiant and BeyondTrust disclosed the full attack chain on October 15-16. This post explains what the attacker did, what the patch situation is, and what your team needs to verify right now.
What happened
CVE-2026-102764 (CVSS 9.3) is an improper origin validation flaw in BeyondTrust Remote Support's internal messaging component. A remote attacker can abuse it to perform arbitrary file operations on affected appliances without authentication. Affected self-hosted versions are 24.3.1 through 26.2.3. BeyondTrust pushed patches to SaaS customers on October 9. Self-hosted operators must apply the BT26-05-RS patch now, or upgrade to a fixed version if on an older branch. The exploitation window ran from August 29 to October 9: about six weeks.
The attack chain
Mandiant documented a methodical post-exploitation sequence. After the initial CVE-2026-102764 access, Armory Castle deployed SAWFLY, a PHP webshell for interactive access and encrypted command-and-control. Traffic was routed through commercial VPN exit nodes and compromised home and small-office routers to blend in with legitimate traffic. Root access came from a SUID copy of /bin/sh that survives reboots. The group then used BeyondTrust's own bt-secrets CLI to exfiltrate stored credentials, and abused configuration templates for passwordless root. BARECLAW, a custom SOCKS5 proxy tunneler, was installed, and haproxy.conf was modified to expose it to the internet. Finally, the group used compromised admin credentials to move laterally into downstream systems listed in the Jump Item list and exfiltrated documents. All system, web server, and application logs were wiped on exit.
AI tooling in the exploit chain
BeyondTrust's own assessment states Armory Castle used AI tooling to develop the exploit chain. This matches a pattern Mandiant has documented for other China-nexus actors in 2026: faster weaponization cycles compressing weeks of reverse engineering into days. If you model China-nexus actor timelines, adjust your assumptions downward on time from target selection to operational zero-day.
What you need to do
Apply the BT26-05-RS patch immediately if you run self-hosted BeyondTrust Remote Support versions 24.3.1 through 26.2.3. Treat any internet-reachable appliance running a vulnerable version during the August 29 to October 9 window as potentially compromised until you complete a forensic review. Look for SAWFLY webshells, BARECLAW tunneler artifacts in haproxy.conf, SUID copies of /bin/sh, and unauthorized root accounts. Review the Jump Item list for lateral movement into downstream systems. SaaS customers were patched October 9 and need no appliance action, but should review downstream system access logs for anomalous activity in the same window.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help assessing exposure or building detection for remote-access tooling attacks.