China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-linked cyber espionage group Armory Castle (UNC5221/Warp Panda) exploited a zero-day vulnerability, CVE-2026-102764, in BeyondTrust Remote Support appliances to gain unauthorized file access and compromise self-hosted servers. The flaw, an improper origin validation in an internal messaging component, was exploited starting August 29, 2026, on a single appliance. Following compromise, the actor deployed a PHP web shell named SAWFLY, established persistence via a custom SOCKS5 proxy (BARECLAW), escalated privileges, stole credentials using proprietary tools, and conducted lateral movement across downstream systems, while also obfuscating activity by deleting logs.

AI-extracted · verify before operational use