A suspected Chinese espionage group had a master key to some of the most sensitive software in corporate IT — and nobody noticed for roughly seven weeks. Google Threat Intelligence Group (GTIG) revealed this week that the actor it tracks as Armory Castle exploited a critical zero-day vulnerability in BeyondTrust Remote Support, a tool that lets IT teams connect to and troubleshoot systems across a network, turning a piece of trusted support software into a launchpad for spying.
The flaw, catalogued as CVE-2026-102764 and rated critical with a CVSS 4.0 score of 9.3, is an improper origin-validation bug in the product's internal messaging components. In plain terms, an unauthenticated attacker could impersonate a trusted entity and perform file operations on the appliance — a foothold that can lead to full host control and access to every credential the appliance stores or brokers.
Seven weeks of silent access
According to GTIG and its incident-response arm Mandiant, the exploitation began as early as August 29 — weeks before BeyondTrust disclosed the flaw on October 15. Mandiant stumbled onto the activity in late September while investigating a different zero-day aimed at edge devices from another vendor; it alerted BeyondTrust, which found an affected SaaS instance during a fleet-wide hunt and contained it within 27 minutes.
That is where the quiet part ends. Once inside, Armory Castle — previously tracked by Mandiant as UNC5221, and by CrowdStrike under the name WARP PANDA — behaved like operators who knew the building. The group deployed two custom implants: SAWFLY, an obfuscated PHP webshell that uses a custom Base32 transport with RC4 encryption and returns a bland 404 response when its trigger parameter is missing, and BARECLAW, a SOCKS5 tunneling tool that communicates over WebSockets to quietly move data out.
Privilege escalation followed a similarly deliberate script. The attackers copied /bin/sh to /usr/bin/dbus-authd, changed the copy's owner to root and flipped on the SUID bit — a classic route from an unprivileged web-service account to root access. From there they harvested credentials, altered permissions, cleaned up logs and other artifacts, and tunneled deeper into victim networks.
A trusted IT tool turned inside out
Remote-support appliances are among the highest-value targets an attacker can find: compromise one and you inherit the privileges IT already holds. BeyondTrust's advisory notes that all supported Remote Support versions through 26.2.3 are affected. SaaS customers were patched by October 9, but self-hosted administrators must verify their automatic updates or apply the BT26-05-RS fix through the appliance interface — and those on older releases need to upgrade first.
The campaign also carries a familiar signature. Analysts noted it echoes earlier Chinese operations against edge devices, including the exploitation of Ivanti VPN appliances — internet-facing security and access tools remain the preferred doorway.
What to do now
GTIG says it is aware of only a small number of compromised organizations so far, but cautioned that the stealth of the activity means more victims may surface. BeyondTrust says it agrees with the attribution assessment at moderate to high confidence. Administrators running self-hosted Remote Support should patch immediately, hunt for the SAWFLY and BARECLAW artifacts, and rotate any credentials the appliance may have brokered. Seven weeks is a long head start — and in espionage, dwell time is everything.
