CVE-2026-102764 — a critical BeyondTrust Remote Support vulnerability rated 9.3 on the CVSS scale — was actively exploited in August 2026 by a suspected China state‑sponsored espionage actor, Google reported on October 15.
Armory Castle: an espionage actor with a persistent focus
Google identifies the threat actor behind the exploitation as Armory Castle, an espionage group active since October 2023 and "known for long-term intelligence collection on behalf of the People’s Republic of China (PRC)." The group’s documented targets include legal services, SaaS providers, business-process outsourcers, technology companies, and government. Google assessed with high confidence that Armory Castle will continue to leverage zero-day vulnerabilities in edge devices to gain access to environments that support their espionage objectives.
Following exploitation of CVE-2026-102764 in August 2026, Google observed Armory Castle escalate privileges and establish persistent access on compromised BeyondTrust Remote Support appliances. The vendor publicly disclosed the vulnerability on October 15 and released a patch on October 8 for both SaaS and self-hosted customers; BeyondTrust said it was withholding technical details while appliances are still being patched to avoid placing customers at increased risk.
Sawfly, SUID escalation and tunneling: specific post‑compromise techniques
Google’s analysis describes a sequence of post‑exploitation steps tailored to BeyondTrust systems. A key component was Sawfly, described by Google as "an obfuscated, lightweight PHP webshell that implements bidirectional encrypted command and control (C2) communication." Using the webshell, the actor copied the system shell executable to /usr/bin/dbus-authd, changed the file owner to root and enabled Set User ID (SUID) permissions — creating a persistent root‑level backdoor on the host system.
The actor also deployed a tunneler tool called Bareclaw to move traffic through the appliance and systematically deleted system, web server and application‑level logs to impede detection. As Google researchers summarized, "Throughout the intrusion, Armory Castle leveraged a deep understanding of BeyondTrust appliance internals, as evidenced by their abuse of proprietary CLI utilities, startup configuration templates and local reverse-proxy routing."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCredential harvesting and configuration abuse inside appliances
BeyondTrust appliances became a focal point for credential access and downstream reach. Armory Castle attempted to harvest credentials from the appliance's native secrets management database by invoking the /ns/sbin/bt-secrets binary — a proprietary administrative CLI utility for managing, storing and retrieving passwords, API keys and endpoint credentials. The actor also altered BeyondTrust configuration templates to give the site service account passwordless root privileges.
In addition to elevating local privileges, the group directly modified account permissions inside the appliance, upgrading local Jump Items and Team permissions from "No Access" to "Administrator," which in Google’s findings granted the actor permanent authorization to launch remote sessions to downstream systems listed in the appliance’s Jump Item list. The actors used the native BeyondTrust Remote Support file transfer service to download and exfiltrate internal documents useful for network reconnaissance, including software inventories.
BeyondTrust patching, Google’s guidance and preservation of telemetry
BeyondTrust issued a patch on October 8 for SaaS and self‑hosted customers and publicly disclosed the flaw on October 15. Google urged affected customers to apply patches immediately and to preserve telemetry before carrying out remediation to maintain an audit trail of potential threat actor activity. Google warned: "Organizations should prepare for potential widespread exploitation following this disclosure, as Armory Castle and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public."
Google’s recommended actions for organizations who may be targeted include:
- Block inbound traffic to the appliance's public address at the firewall rather than in /appliance
- Deny outbound traffic except to BeyondTrust update and licensing endpoints, and log every denied connection
- End active support sessions and disable new sessions, Jump Clients, Jumpoints, and API accounts from /login
- Redeploy appliances with confirmed or unknown compromise status from a clean, fully patched image
- Restrict access to the /login and /appliance administrative interfaces by IP or network segment at the appliance level
- End all active support sessions, then redeploy Jump Clients, Jumpoints, and the representative console from the patched or rebuilt appliance to invalidate existing tokens
- Rotate credentials in dependency order
- Apply control plane restrictions, including ensuring the built‑in Admin account is configured with multi‑factor authentication (MFA)
What this means for technologists, procurement leaders, and affected enterprises
Technologists and security teams should prioritize applying the October 8 patch immediately, preserve telemetry for forensic review, and implement the network and access restrictions Google lists to contain potential lateral movement. Procurement leaders and enterprise buyers will need to track vendor patch timelines and operational choices such as the decision to withhold technical details during active remediation. Affected enterprises should assume that credentials and downstream session tokens could be compromised and follow Google’s guidance to redeploy or rebuild appliances and rotate credentials in dependency order.
The facts are stark and specific: an edge device zero‑day (CVE-2026-102764, CVSS 9.3) was exploited months before public disclosure, the attackers deployed tools and configuration changes that grant long‑lived, root‑level access, and Google warns broad exploitation is likely once the issue is public. Applying the patch, preserving telemetry and implementing the access controls Google recommends are the immediate, concrete steps organizations named in Google’s findings can take now.
