Adversary Intelligence — 2026-10-17

Chinese State-Backed Group Armory Castle Exploits BeyondTrust Zero-Day to Conduct Espionage Against Government Agencies and Tech Firms

BLUFIt is genuinely uncertain whether additional victims of the BeyondTrust zero-day will be publicly identified by November 17, but self-hosted operators lacking off-box logging face the highest undetected compromise risk.

BeyondTrust said the China-nexus actor Mandiant and Google now call Armory Castle (UNC5221) exploited zero-day CVE-2026-102764 in Remote Support starting August 29, hitting one BeyondTrust-hosted instance and one self-hosted appliance 1. Mandiant reported custom malware named Sawfly and Bareclaw, and Cybersecurity Dive described Sawfly as a PHP web shell and Bareclaw as a SOCKS5 tunneler, with root access and theft of all stored credentials 23. BeyondTrust said it released patch BT26-05 on October 8, while Cybersecurity Dive gave October 9 13. A GTIG analyst told Cybersecurity Dive that only a small number of victims are known, and CISA added the flaw to its Known Exploited Vulnerabilities catalog 3.

Analysis
It is genuinely uncertain whether BeyondTrust, Mandiant/Google or a government agency will name an additional confirmed victim or report a materially larger count than the two known instances by November 17. Confidence is low because the count rests on the vendor's own telemetry and a Google analyst's acknowledgment that more compromises are possible, with no independent scanning data published and the secondary reporting largely derivative of one vendor disclosure. The count may nonetheless be close to complete, since the actor uses zero-days selectively against chosen targets and BeyondTrust has seen no adversary activity since August. Armory Castle has historically broadened exploitation of unpatched appliances once a flaw is public, so self-hosted operators face the greatest exposure in the coming weeks. Log deletion and exposed stored credentials may leave defenders without off-box logging unable to confirm or exclude compromise. If more victims surface, operators and federal agencies shift from patching to compromise assessment and credential rotation.

4 sources

ARMORY CASTLE and BT26-05: What Security Teams Need to Know - BeyondTrust
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day - The Record
China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign - Cybersecurity Dive
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day - SecurityWeek