BeyondTrust's Federal Deadline Is Tomorrow. Patching Won't Tell You Whether ARMORY CASTLE Already Got In.
If you run BeyondTrust Remote Support on your own hardware, the federal deadline to fix CVE-2026-102764 is tomorrow, October 19. Patching closes the door. It does not tell you whether someone already walked through it, and according to Google's threat intelligence group, someone had been walking through it since late August.
What happened
CVE-2026-102764 is an arbitrary file upload in BeyondTrust Remote Support (formerly Bomgar), every supported version through 26.2.3. Google Threat Intelligence Group found it during an incident response engagement and attributes the activity to ARMORY CASTLE, the group it previously tracked as UNC5221 and assesses as a suspected China-nexus espionage actor. BeyondTrust patched its cloud tenants on October 9 and published advisory BT26-05 on October 15. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16 with a three-day deadline.
What the attacker did once inside
GTIG's account is worth reading in full, because it shows how much a remote-support box hands over:
A webshell, then root. A PHP webshell GTIG calls SAWFLY, then a copy of the system shell with root ownership and the SUID bit set, at /usr/bin/dbus-authd.
The vault. BeyondTrust's own bt-secrets utility, run to pull stored credentials and API keys.
Persistence that survives a reboot. A boot script that adds a passwordless sudo rule to the sudoers template.
Its own way back in. A tunneler GTIG calls BARECLAW, a SOCKS5 proxy over WebSocket, exposed through the appliance's own HAProxy on a path named /uidchanarge.
Then your network. Jump Item and Team roles raised to Administrator, sessions into internal machines, and documents taken out through the product's normal file transfer.
Then the logs. The appliance's own logs were deleted, which is why the evidence you need is mostly off the box.
What to do
Patch. Self-hosted 24.3.1 or later: apply BT26-05-RS from /appliance. Older: upgrade to a supported version first, then patch.
Assume it was reachable, and hunt. If the appliance was reachable from the internet between late August and your patch date, treat it as possibly compromised. Snapshot it (with memory) before you change anything.
Check the box: /usr/bin/dbus-authd, a zz-root-persist file under /home/bomgar/sbin/post_boot.d, NOPASSWD lines in /ns/config/sudoers.template, /uidchanarge or port 19800 in /ns/config/haproxy.conf, and any PHP file you didn't put there.
Check off the box, because the attacker cleaned up on it: gaps in your syslog forwarding, roles raised to Administrator, new users or API accounts with no ticket behind them, unknown PHP paths and WebSocket upgrades at your proxy or WAF.
Rotate what the vault held. If you find anything, every credential stored in Remote Support should be treated as known to the attacker.
What's in our feed, and what we saw
The two file hashes GTIG published, for the SAWFLY webshell and the BARECLAW tunneler, have been in our hashes.csv since October 17 at confidence 90, attributed to GTIG's report. That is GTIG's research, not our detection, and we name them as the source in every row. GTIG published no IP addresses or domains, so there is nothing for our IP or domain lanes; the full indicator set sits in a Google Threat Intelligence collection for registered users.
Our own edge saw nothing, and that is not reassurance. We don't run BeyondTrust and have no decoy for its paths, so a zero from us means we were not positioned to see it, not that nobody was looking. The same was true of the three appliances in our October 15 post: the box you buy to stand at the front door has become the front door, and it is the one place nobody puts an endpoint agent.
Credit to Google Threat Intelligence Group and Mandiant for the investigation and the hunting guidance this post leans on, and to BeyondTrust for publishing the advisory and patch.
We checked each date, path and hash in this post against GTIG's report, BeyondTrust's advisory, CISA's catalog and our own downloadable feed before publishing. At least 5% of what remains is still wrong, and we don't know which.
If this was useful, or if it wasn't, rate it at the bottom of the page. It is the only direct signal we get.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=beyondtrust-s-federal-deadline-is-tomorrow-patching-won-t-tell-you-whether-armory-castle-already-go
Comments