BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs

A China-linked espionage group tracked by Mandiant as Armory Castle (formerly UNC5221/UTA0178) exploited a critical zero-day flaw in BeyondTrust Remote Support appliances, starting August 29, 2026. The bug, CVE-2026-102764, carries a 9.3 CVSS score and stems from an internal messaging component that failed to verify the origin of incoming messages. Within minutes of weaponizing the flaw, attackers deployed a custom PHP webshell called SAWFLY, raided the appliance's secrets vault for passwords, API keys and credentials, wiped logs, escalated to admin privileges, and used a new tunneling tool named BARECLAW to move through victim networks and exfiltrate data. BeyondTrust shipped a fix on October 9 and urges all on-premises customers to patch immediately, hunt for signs of compromise, and limit internet exposure of management tools; the incident adds to a string of recently disclosed, actively exploited edge vulnerabilities in products from Ivanti, Cisco, and Palo Alto Networks.