Quick Takeaways
- A Chinese state-backed group, Armory Castle, exploited a new zero-day (CVE-2026-102764) in BeyondTrust appliances to conduct long-term espionage, gaining access to all stored credentials and modifying files to persist despite resets.
- The attackers used custom malware (Sawfly and Bareclaw) and exploited proprietary internals to escalate privileges, move laterally within networks, and maintain deep access.
- The group has a history of widespread opportunistic exploitation of vulnerabilities in critical software (e.g., Ivanti, Citrix), often targeting technology firms and governments to facilitate intelligence collection and exploit unpatched systems.
Threat, Attack Techniques, and Targets
An alleged Chinese state-backed group is using a new zero-day in BeyondTrust software to conduct espionage. This group is called Armory Castle or UNC5221. They exploit a vulnerability known as CVE-2026-102764. The zero-day affects BeyondTrust Remote Support appliances, which allow IT teams to access and troubleshoot remote devices securely.
The attackers first exploited the zero-day on August 29. They used the vulnerability to gain initial access, then escalate their privileges. This allowed them to move inside the network and deepen their control. They used custom malware called Sawfly and Bareclaw. The group also obtained all stored credentials on the appliances. They could modify files that survive system reboots and resets.
The group has targeted legal services, SaaS providers, business-process outsourcers, technology companies, and government organizations. They focus on technology firms to learn about other zero-day exploits. The group has been active since October 2023 and operates in many countries and industries. They often exploit vulnerabilities openly after they are made public, aiming for quick access before patches are available.
Impact, Security Implications, and Remediation Guidance
This attack can result in long-term intelligence gathering by the threat group. If a vulnerable appliance is connected to the internet, it could already be compromised. The attackers can access sensitive data, move laterally within networks, and maintain persistent control.
The security implications are serious. Organizations using BeyondTrust appliances should treat any exposed systems as compromised until checked. Because the group can take all stored credentials and modify files, there is a high risk of data leaks and system compromise.
Remediation guidance should be obtained from the vendor or relevant authority. BeyondTrust has released a patch for the zero-day. Several mitigations are also available. Organizations should review their systems, apply patches promptly, and follow best security practices to reduce risk.
Continue Your Tech Journey
Explore the future of technology with our detailed insights on Artificial Intelligence.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
