Mandiant ties SAWFLY web shell deployments to ARMORY CASTLE’s BeyondTrust Remote Support breach
Attackers used an unauthenticated flaw in BeyondTrust Remote Support to upload files and deploy web shells on self-hosted appliances.
Key points
- CVE-2026-102764 allows unauthenticated file operations on Remote Support versions 26.2.3 and earlier.
- Mandiant linked the exploitation to the ARMORY CASTLE espionage actor, who deployed the SAWFLY web shell.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with an October 19 remediation deadline.
Attackers gained the ability to upload arbitrary files and install persistent backdoors on BeyondTrust Remote Support appliances without needing valid credentials. This capability allowed the threat group to deploy the SAWFLY PHP web shell and the BARECLAW tunneler, granting them root-level access and the means to extract stored credentials.
In plain English
The flaw in BeyondTrust Remote Support lets outsiders interact with the appliance as if they had administrative rights. They do not need to guess passwords or steal login tokens. Instead, they send specially crafted messages that the system accepts as legitimate, allowing them to write files to the server’s storage.
The background
BeyondTrust disclosed the issue on October 15, 2026, confirming that exploitation had already occurred in the wild. Two known compromises date to August 29, 2026, involving one hosted instance and one self-hosted appliance. Mandiant corroborated findings from the self-hosted investigation on September 30, attributing the activity to ARMORY CASTLE.
What changes now
CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities list on October 16, setting an October 19 due date for remediation. BeyondTrust released the BT26-05-RS patch for versions 24.3.1 through 26.2.3. Organizations must apply this update immediately and investigate appliances for prior compromise, as patching does not remove existing persistence mechanisms.
What made it possible
Authentication bypass flaws often arise when systems fail to verify the origin or integrity of incoming requests before executing sensitive actions. In intrusion chains, this weakness serves as the initial access vector, allowing attackers to establish a foothold without triggering standard login alerts. Teams usually monitor for unexpected file changes or administrative sessions from unusual network locations to detect such activity early.
What to do and how to stay safe: BeyondTrust
- Apply the BT26-05-RS patch to all self-hosted Remote Support appliances running versions 24.3.1 through 26.2.3 immediately.
- Investigate affected appliances for signs of compromise, such as the SAWFLY web shell or BARECLAW tunneler, even after patching.
- Rotate all stored or brokered credentials and review administrative changes made during the exposure window.
- Preserve forensic evidence on suspected systems before rebooting or making changes, and rebuild from clean images if compromise is confirmed.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of BeyondTrust Remote Support are affected by CVE-2026-102764?
Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied.
Is there a patch available for this vulnerability?
Yes, BeyondTrust has released the BT26-05-RS patch for versions 24.3.1 through 26.2.3.
Did CISA add this vulnerability to its Known Exploited Vulnerabilities list?
Yes, CISA added CVE-2026-102764 to the KEV catalog on October 16, 2026.
