China's Armory Castle Exploits Critical BeyondTrust Vulnerability
A suspected state-sponsored actor from China has been identified as exploiting a newly disclosed critical vulnerability in BeyondTrust Remote Support software, according to a warning from Google. The threat actor, known as Armory Castle, has been observed escalating privileges and establishing persistent access to compromised BeyondTrust appliances following the exploitation of the flaw, designated CVE-2026-102764, which was reported in August 2026.
BeyondTrust publicly disclosed this vulnerability on October 15, 2026, with a CVSS rating of 9.3. A patch was made available on October 8 for both software-as-a-service (SaaS) and self-hosted customers. The company has chosen to withhold technical details about the vulnerability to prevent increased risk to customers still in the process of applying the patch.
In a blog post published on October 15, Google urged affected BeyondTrust customers to apply the patches without delay. The tech giant warned that organizations should prepare for potential widespread exploitation following this disclosure, as Armory Castle and other threat actors have a history of opportunistic exploitation once vulnerabilities become public.
Armory Castle is recognized as an espionage actor that has been active since October 2023, focusing on long-term intelligence collection for the People's Republic of China. The group has targeted various sectors, including legal services, SaaS providers, business-process outsourcing, technology companies, and government entities.
Google has high confidence that Armory Castle will continue to exploit zero-day vulnerabilities in edge devices to facilitate their espionage activities. After successfully exploiting CVE-2026-102764, the group employed post-compromise tactics designed to establish persistence and enable lateral movement within victim environments, specifically targeting BeyondTrust systems.
A significant aspect of Armory Castle's operations involved deploying Sawfly, an obfuscated PHP webshell that allows for bidirectional encrypted command and control communication. This webshell was used to escalate privileges by copying the system shell executable to the file /usr/bin/dbus-authd, modifying its ownership to root, and enabling Set User ID (SUID) permissions. This effectively provided the attackers with a persistent root-level backdoor on the host system.
Escalation of Privileges and Access Control
The group then elevated privileges from the web service account to root-level control of the appliance host, gaining access to all credentials stored or managed by the appliance and the ability to modify files that would survive a reboot or configuration reset. They attempted to harvest credentials directly from the appliance's native secrets management database using the /ns/sbin/bt-secrets binary, a proprietary command line interface utility for managing passwords, API keys, and endpoint credentials.
Persistent access was achieved by altering the BeyondTrust configuration templates to grant passwordless root privileges to the site service account. Researchers noted that the actor modified the compromised account's permissions, upgrading local Jump Items and Team permissions from 'No Access' to 'Administrator', thereby granting permanent, unrestricted authorization to launch remote sessions to downstream systems listed within the appliance's Jump Item list.
Armory Castle also utilized the BeyondTrust Remote Support file transfer service to download and exfiltrate sensitive internal documents, such as software inventories, directly from users' desktop environments. A tunneling tool named Bareclaw was deployed to facilitate traffic movement through the BeyondTrust device.
Final Assessment
To evade detection, the group systematically deleted logs at the system, web server, and application levels. Google researchers highlighted that Armory Castle demonstrated a deep understanding of BeyondTrust appliance internals, evidenced by their exploitation of proprietary CLI utilities, startup configuration templates, and local reverse-proxy routing.
In addition to applying the patch for CVE-2026-102764, Google has provided several recommendations for organizations that may be targeted by Armory Castle. Security teams are advised to preserve telemetry before taking action to maintain an audit trail of any potential threat actor activity.
