Loading story…
Mandiant reported that ARMORY CASTLE, a suspected China-linked espionage actor formerly tracked as UNC5221, exploited an arbitrary file-upload vulnerability in BeyondTrust Remote Support appliances as a zero-day in late August 2026. BeyondTrust disclosed the flaw, CVE-2026-102764, on October 15. During an incident response engagement, Mandiant found that the attacker used appliance-specific utilities and configuration changes to escalate privileges, establish persistence, and enable lateral movement, deploying the newly identified SAWFLY webshell and BARECLAW tunneler.
The intrusion involved changes to privileged access and reverse-proxy routing, alongside extensive log deletion to evade detection. Mandiant urged organizations to apply BeyondTrust patches immediately, warning that public disclosure could lead to widespread exploitation. Defenders should also investigate affected appliances for unauthorized privileged-access changes, altered proxy configurations, evidence of log deletion, and the reported malware; patching alone does not remove an existing compromise.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
BeyondTrust disclosed the arbitrary file-upload vulnerability CVE-2026-102764 affecting its Remote Support appliances.
ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221, exploited CVE-2026-102764 in late August 2026. The vulnerability permits arbitrary file uploads to BeyondTrust Remote Support appliances.
Mandiant reported incident-response evidence linking the zero-day exploitation to ARMORY CASTLE and detailed the actor's appliance-specific post-exploitation techniques. The report supplied investigation artifacts and YARA rules for SAWFLY and BARECLAW.
BeyondTrust provided security patches for the vulnerability. Mandiant urged affected organizations to apply them immediately and review BeyondTrust's additional guidance.
BeyondTrust initiated an investigation for similar activity after successful exploitation involving another security-device provider became public on September 27, 2026. The reference does not specify when BeyondTrust began its investigation.
ARMORY CASTLE used compromised Administrator credentials to open remote sessions on downstream systems and move laterally through victim networks beyond the compromised BeyondTrust appliances.
Following exploitation, ARMORY CASTLE deployed the SAWFLY webshell and BARECLAW tunneler, modified startup and sudoers configurations for privileged persistence, and changed reverse-proxy routing to support tunneling. The actor also elevated remote-access roles and deleted appliance logs and endpoint artifacts to evade detection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcebleepingcomputer.com
Open sourcecloud.google.com
Open sourcebeyondtrust.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical **pre-authentication remote code execution** flaw in BeyondTrust Remote Support and some older versions of Privileged Remote Access, tracked as `CVE-2026-1731`, has been actively exploited against internet-facing systems. The bug is described as an unauthenticated operating system command injection vulnerability that lets attackers execute arbitrary commands on affected servers. BeyondTrust patched its SaaS customers on February 2 and urged self-hosted customers to apply fixes, while **CISA** added the vulnerability to its Known Exploited Vulnerabilities catalog and public exploit code later appeared on GitHub. Incident responders and threat researchers reported a rise in post-exploitation activity across multiple BeyondTrust customers in sectors including **financial services, technology, higher education, legal services, and healthcare**. Palo Alto Networks Unit 42 observed attackers deploying **SparkRAT** and **vShell** backdoors, using remote management and tunneling tools for reconnaissance and persistence, and in some cases conducting environment enumeration and suspected data theft. Censys and other researchers also warned that exposed BeyondTrust instances were reachable from the internet, underscoring the risk of rapid compromise where patches had not been applied.
Jun 29, 2026
**BeyondTrust Remote Support** is being actively exploited via **CVE-2026-1731**, a **critical pre-authentication OS command injection / RCE** flaw (CVSS **9.9**) in the `thin-scc-wrapper` component exposed to the internet via **WebSocket**. Reporting indicates attackers can execute system commands without logging in, enabling rapid progression from initial access to full compromise, including reconnaissance, account creation, webshell deployment, C2 activity, lateral movement, and data theft. Victimology described to date spans multiple sectors—**financial services, healthcare, legal services, higher education, and technology/retail**—across the **U.S., France, Germany, Australia, and Canada**, with telemetry indicating **10,600+** exposed instances potentially at risk. Threat activity observed in exploitation includes deployment of two prominent remote-access backdoors: **VShell** (noted for stealthy, service-like behavior and fileless/memory execution on Linux) and **SparkRAT** (an open-source Go-based RAT previously seen in campaigns linked to *DragonSpark*). Due to confirmed exploitation, **CISA added CVE-2026-1731 to the KEV Catalog** (Feb. 13, 2026), signaling urgent patching/mitigation prioritization. Separate reporting in the same period covered unrelated critical issues in **GNU Inetutils telnetd (CVE-2026-24061)** and an exploitation surge affecting **Ivanti** products (**CVE-2025-0282/CVE-2025-0283**), but those are distinct from the BeyondTrust activity.
Jun 29, 2026
BeyondTrust disclosed and fixed **CVE-2026-1731**, a critical unauthenticated remote code execution flaw affecting **Remote Support 25.3.1 and earlier** and **Privileged Remote Access 24.3.4 and earlier**. The vulnerability allows a remote attacker to send crafted client requests and execute system commands on the target appliance as the **site user**, creating a path to full system compromise, data theft, and service disruption. CSIRT.SK reported the issue carries a **CVSS score of 9.9**. BeyondTrust said cloud instances were updated automatically, while organizations running on-premises deployments were told to upgrade to **Remote Support 25.3.2** and **Privileged Remote Access 25.1.1**, or apply the vendor patches **`BT26-02-RS`** and **`BT26-02-PRA`**. The advisory identifies the flaw as a high-priority risk for enterprises using BeyondTrust remote access and support platforms because exploitation requires no authentication and can result in command execution on exposed systems.
Jul 24, 2026