← Sunday, October 18, 2026SecurityVulnerability

ARMORY CASTLE exploited a BeyondTrust flaw to upload files and maintain access

cloud.google.com by Google Threat Intelligence Group, Mandiant 16 min read Editor score 7/10

Mandiant found that ARMORY CASTLE exploited a BeyondTrust Remote Support vulnerability as a zero-day, then escalated privileges and established persistence. The observed intrusion and defensive guidance make this more useful than a routine single-product advisory.

What

CVE-2026-102764 allows arbitrary file uploads to BeyondTrust Remote Support appliances; Mandiant found ARMORY CASTLE exploited it as a zero-day.

How

After exploitation, ARMORY CASTLE staged the SAWFLY PHP webshell, used the BARECLAW tunneler, escalated privileges and deleted logs and artifacts.

Why it matters

The actor abused appliance internals to persist and evade detection, underscoring the need to patch remote-access systems and review incident evidence.

Read on cloud.google.com →

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.