{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-102764/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["ARMORY CASTLE"],"_cs_cpes":["cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-102764"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Remote Support"],"_cs_severities":["critical"],"_cs_tags":["espionage","webshell","cve-2026-102764","beyondtrust"],"_cs_type":"threat","_cs_vendors":["BeyondTrust"],"content_html":"\u003cp\u003eIn late August 2026, the threat actor ARMORY CASTLE (formerly tracked as UNC5221) began exploiting a zero-day vulnerability, CVE-2026-102764, in BeyondTrust Remote Support appliances. This vulnerability allows for arbitrary file uploads, enabling the actor to achieve remote code execution. Upon gaining an initial foothold, the actor deployed the custom SAWFLY PHP webshell to interact with the device. ARMORY CASTLE demonstrated extensive knowledge of the appliance's internals, utilizing proprietary binaries such as 'bt-secrets' to extract sensitive credentials from the native vault. The actor maintains persistence and ensures root-level control by manipulating SUID permissions and modifying startup configuration templates. These intrusions represent a sophisticated effort to gain persistent access to enterprise remote support infrastructure, facilitating potential lateral movement and long-term espionage within target organizations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker exploits the arbitrary file upload vulnerability CVE-2026-102764 by initiating POST requests to the endpoint '/app_84304470.php'.\u003c/li\u003e\n\u003cli\u003eThe SAWFLY webshell ('mangoapi.php') is written to the web root path '/%SITE_SERVICE_ACCOUNT%/ingredi/app/laravel/public/'.\u003c/li\u003e\n\u003cli\u003eThe actor executes commands via the webshell under the unprivileged site service account.\u003c/li\u003e\n\u003cli\u003ePrivilege escalation is achieved by copying '/bin/sh' to '/usr/bin/dbus-authd' and setting the SUID bit on the file.\u003c/li\u003e\n\u003cli\u003eThe actor leverages the administrative CLI utility '/ns/sbin/bt-secrets' to dump administrative passwords and API keys from the appliance vault.\u003c/li\u003e\n\u003cli\u003ePersistence is established by creating a startup script 'zz-root-persist' in the '/home/bomgar/sbin/post_boot.d' directory.\u003c/li\u003e\n\u003cli\u003eArtifacts are cleaned up by deleting logs in '/home/bomgar/log/bt-secrets.log' to evade detection.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants attackers full administrative control over the BeyondTrust Remote Support appliance. This exposure includes the potential compromise of all managed credentials, persistent backdoor access, and the ability to intercept remote support sessions, impacting the security of all downstream endpoints managed by the compromised device.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the security patches provided by BeyondTrust for CVE-2026-102764 immediately.\u003c/li\u003e\n\u003cli\u003eMonitor for the creation of files with SUID permissions in /usr/bin/ or other non-standard directories.\u003c/li\u003e\n\u003cli\u003eAudit logs for execution of the '/ns/sbin/bt-secrets' utility, particularly with arguments like 'get' or 'vault'.\u003c/li\u003e\n\u003cli\u003eMonitor for the creation of files within the '/home/bomgar/sbin/post_boot.d' directory.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rules to detect the SAWFLY webshell traffic and SUID manipulation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T22:20:03Z","date_published":"2026-10-15T22:20:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-armory-castle-beyondtrust/","summary":"The PRC-nexus actor ARMORY CASTLE is exploiting the arbitrary file upload vulnerability CVE-2026-102764 in BeyondTrust Remote Support appliances to deploy web shells, escalate privileges, and harvest credentials.","title":"ARMORY CASTLE Exploitation of BeyondTrust Remote Support","url":"https://feed.craftedsignal.io/briefs/2026-10-armory-castle-beyondtrust/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-102764","version":"https://jsonfeed.org/version/1.1"}