Loading malware…
SAWFLY is a lightweight PHP web shell that provides interactive remote access and bidirectional encrypted command-and-control communication on compromised BeyondTrust Remote Support appliances. It is associated with Armory Castle, a suspected China-nexus cyberespionage actor formerly tracked as UNC5221 and also known as Warp Panda. SAWFLY was deployed following zero-day exploitation of CVE-2026-102764 in late August 2026.
The web shell served as a post-exploitation foothold supporting privilege escalation, administrative control, and reboot-surviving persistence on Linux-based enterprise remote-support appliances. In the associated intrusion, the attackers abused appliance-specific utilities and configuration templates, obtained root privileges, attempted to retrieve stored credentials, and used compromised administrator accounts to access downstream endpoints. SAWFLY was deployed alongside BARECLAW, a separate tunneling tool. The attackers also deleted system, web-server, and application logs to conceal their activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier. | Next, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remote sessions on downstream systems.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Next, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remote sessions on downstream systems.
Next, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remote sessions on downstream systems.
A successful compromise is followed by the deployment of a lightweight PHP web shell codenamed SAWFLY for interactive remote access and bidirectional encrypted command-and-control (C2) communication.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Lightweight PHP web shell deployed by Armory Castle after compromising a BeyondTrust Remote Support appliance. It provides interactive remote access and encrypted bidirectional C2, serving as a conduit for privilege escalation, administrative control, and reboot-persistent access.
Web shell deployed by Armory Castle after exploitation of BeyondTrust Remote Support appliances. It established a foothold in an attack chain involving root-level privilege escalation, access to appliance credentials, log deletion, and lateral movement.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.