Armory Castle Exploits BeyondTrust Zero-Day Vulnerability
The cyber espionage group known as Armory Castle, previously referred to as UNC5221 or Warp Panda, has successfully exploited a newly identified security flaw in BeyondTrust Remote Support, a tool formerly known as Bomgar. This zero-day vulnerability, tracked as CVE-2026-102764, was disclosed in late August 2026 and is characterized by a CVSS score of 9.3, indicating a critical level of severity.
BeyondTrust reported that the vulnerability arises from improper origin validation within an internal messaging component, which could allow remote attackers to perform unauthorized file operations on affected appliances. In a recent alert, the company stated, "The vulnerability exists within internal components of Remote Support. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance."
As of October 9, 2026, patches have been deployed to all Remote Support SaaS customers. Self-hosted customers using versions from 24.3.1 to 26.2.3 are advised to manually update to the BT26-05-RS patch. Those running versions older than 24.3.1 must upgrade to a newer version to apply the fix.
According to a timeline provided by BeyondTrust, Armory Castle exploited this vulnerability on a self-hosted Remote Support appliance on August 29, 2026. Following this, on September 27, 2026, the public disclosure of another security device provider's exploitation prompted BeyondTrust to investigate for similar activities.
Armory Castle has a history of targeting zero-day vulnerabilities in various systems, including Citrix NetScaler and Ivanti Connect Secure, affecting a wide range of sectors such as legal services, technology, and government entities for long-term intelligence collection. The group has been active since October 2023.
Targeted Exploitation Strategies Unveiled
BeyondTrust noted that the actor selectively uses zero-day exploits against chosen targets and typically shifts to broader exploitation once the vulnerability becomes public. The company assessed that Armory Castle strategically selects high-value software targets and maintains a working model of these products to develop exploit chains.
Mandiant, a subsidiary of Google, provided additional insights into the exploitation activities. They reported that successful compromises are often followed by the deployment of a lightweight PHP web shell named SAWFLY, which facilitates interactive remote access and encrypted command-and-control communication.
Final Brief
The threat actor employs commercial VPN exit nodes and compromised home routers to obscure their traffic, using the web shell to escalate privileges and gain full administrative control of the appliance. This intrusion is marked by attempts to steal credentials by accessing stored secrets and leveraging administrative access to infiltrate downstream systems.
Mandiant researchers emphasized that any appliance exposed to the internet and running a vulnerable version during the exploitation window should be considered potentially compromised until thoroughly reviewed.
