Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Install Backdoors

A suspected China-linked espionage group exploited a zero-day vulnerability in BeyondTrust Remote Support appliances to gain initial access, elevate privileges to root, and install tools that provided persistent access to victim environments.

Google’s Threat Intelligence Group (GTIG) reports the activity occurred in late August 2026, before BeyondTrust publicly disclosed the flaw on October 15, 2026.

The vulnerability, tracked as CVE-2026-102764, allowed an unauthenticated remote attacker to perform file operations on a vulnerable appliance.

Mandiant attributed the activity to ARMORY CASTLE, a suspected China-nexus group previously tracked as UNC5221. After exploiting the appliance, the attackers deployed malware, harvested stored credentials, modified account permissions and used the appliance to reach systems managed through it.

Because Remote Support appliances can connect to internal endpoints, a compromise can expose more than the appliance itself. Google Cloud’s Threat Intelligence Group and Mandiant observed the attackers deploy the SAWFLY webshell and the BARECLAW tunneler after exploiting the flaw.

Attack sequence and webshell deployment

Mandiant found evidence of exploitation in multiple appliance logs. The intruder first issued POST requests to /app_84304470%2Ephp. Roughly 11 minutes later the appliance recorded creation of a PHP webshell named mangoapi.php in the web root. Mandiant was unable to recover the file uploaded by the initial POST, so the staging filename should not be treated as a confirmed sample of the malware used to deliver the webshell.

The SAWFLY webshell provided a command channel to the attackers. It inspected incoming POST requests for the parameter _c94mfe and returned an HTTP 404 response when that parameter was missing. When the parameter was present, SAWFLY decoded and decrypted the submitted data, executed PHP code, then encrypted and encoded the output before returning it. That design reduces the likelihood a casual scan will reveal the webshell.

After establishing the webshell, the group escalated privileges from the site service account to root. Mandiant observed the attackers copy /bin/sh to /usr/bin/dbus-authd, change the file owner to root and set the Set User ID (SUID) bit. Because a SUID binary runs with the privileges of its owner, this change provided a path to root-level control. The activity echoes previous reporting on exploitation of BeyondTrust appliances, although those incidents involved different flaws and campaigns.

Persistence, credential access and lateral movement

With root access, the attackers used BeyondTrust’s bt-secrets utility to inspect the appliance secrets store. Mandiant observed attempts to retrieve credentials for a service account and additional queries of the vault. The attackers also removed entries from the utility’s logs. These actions are significant because Remote Support appliances may store or broker credentials that are used to access other systems in an environment.

To survive reboots and configuration resets, the attackers created a startup script named zz-root-persist. The script added the compromised service account to a configuration template with passwordless sudo privileges and invoked a BeyondTrust utility to rebuild the active sudoers file.

Mandiant also documented log tampering across system, web server and application logs, which hinders incident response. The attackers changed a compromised administrator account’s permissions, elevating access to Jump Items and teams from “No Access” to “Administrator.” Jump Items are systems made available for remote support; with expanded permissions the actor could initiate sessions to downstream devices, run file-transfer operations and collect internal documents such as software inventories.

For network tunneling, the intruders deployed BARECLAW, a custom SOCKS5 tunneler that encapsulates traffic over WebSockets. In the observed deployment BARECLAW listened on localhost TCP port 19800. The attackers modified the appliance’s HAProxy configuration so that requests with the path /uidchanarge were routed to the local tunneler. Because the listener was bound to localhost, the proxy route provided an indirect external access point. This technique mirrors a broader pattern of espionage groups using edge appliances as footholds, similar to previous Ivanti zero-day campaigns.

BeyondTrust says CVE-2026-102764 affects supported Remote Support versions up to 26.2.3. Google Cloud and Mandiant urge affected organizations to apply BeyondTrust’s BT26-05 patch.

BeyondTrust patched SaaS tenants on October 9, 2026. Self-hosted customers should apply the BT26-05-RS patch and upgrade older releases to a supported version before patching. Patching removes the vulnerability but does not eliminate forensic evidence of prior compromise.

Organizations should review the full potential exposure period, preserve external firewall and reverse-proxy logs, and check for unexpected web-root files, SUID binaries, startup scripts, sudoers changes, vault access and administrator permission changes. If a compromise is confirmed or cannot be ruled out, Mandiant recommends rebuilding appliances from a clean, patched image rather than relying on rebooting or resetting the device.

Rotate credentials only after patching or rebuilding, so an attacker who still controls the device cannot capture replacement secrets. For further detail, consult Google Cloud’s threat report and BeyondTrust’s BT26-05 advisory.

Indicators of compromise (IoCs)

Note: IP addresses and domains in threat reporting are often intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Only re-fang indicators within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from your SOCs and monitoring systems.