On 16 October 2026 Google Threat Intelligence Group (GTIG) published a report on a suspected PRC-nexus espionage actor it calls ARMORY CASTLE, formerly tracked as UNC5221. GTIG says the actor exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August 2026. This post covers the intrusion chain and the hunting guidance, not the patch details. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 16 October.
What GTIG describes
- The flaw affects supported Remote Support versions up to 26.2.3 and lets an unauthenticated remote attacker perform file operations, which results in arbitrary file upload.
- After upload, a PHP web shell GTIG calls SAWFLY appeared about 11 minutes later.
- The actor copied the shell binary to a hidden path with the SUID bit set for a persistent root backdoor.
- It ran the appliance's secrets tool to dump stored credentials, then deleted the logs of that run.
- It added a boot script that gave the site service account passwordless sudo.
- It logged into the admin portal with compromised credentials and raised its own Jump Item and Team roles to Administrator, which GTIG says granted permanent authorization to launch remote sessions to downstream systems.
- It used the file transfer service to pull documents such as software inventories.
- A tunneler GTIG calls BARECLAW was exposed through a reverse proxy rule on a path chosen to look ordinary.
What is confirmed, reported and unknown
- Confirmed by GTIG and CISA: the CVE, the affected versions, the late August exploitation, the tooling, the attack steps and the KEV listing.
- Assessed, not proven: attribution. GTIG calls the actor "suspected PRC-nexus" and bases it on tooling and techniques matching earlier ARMORY CASTLE activity.
- Reported by a trade outlet: BeyondTrust patched SaaS customers on 9 October. GTIG gives 15 October as the disclosure date. We did not reconcile these.
- Unknown: the number and identity of victims. GTIG names none. It says additional organizations may have been compromised before disclosure.
How to check if you're exposed
GTIG's host artifacts to look for on a self-hosted appliance:
- A SUID file at /usr/bin/dbus-authd
- /tmp/ingredi_ws
- A file named zz-root-persist in the post_boot.d directory
- A NOPASSWD sudo line for the site service account in sudoers.template
- Gaps in syslog forwarding from the appliance
In the admin portal, look for user_changed events that raise a role to Administrator and for new users, API accounts or security providers with no change ticket.
What to do now
- Patch per BeyondTrust advisory BT26-05. Versions older than 24.3.1 must be upgraded first.
- Treat any internet reachable vulnerable appliance as potentially compromised until reviewed. This is GTIG's wording.
- Snapshot the VM with memory and gather proxy and perimeter logs first. GTIG notes that an attacker can delete on appliance logs.
- Rebuild from a known good state. GTIG says host level persistence survives reboot and configuration reset.
- Rotate credentials only after patching or rebuilding, then revoke active sessions.
How this could have been avoided
- Do not expose admin interfaces. CISA advises limiting administrative interfaces to trusted networks.
- Keep secrets out of the appliance vault where you can. GTIG advises keeping privileged credentials out of the Remote Support Vault.
- Phishing resistant MFA through SAML SSO and a default Jump Item role of No Access limit what a stolen admin login does.
- Forward logs off the appliance. Local logs were deleted, and a SIEM copy preserves evidence.
- Alert on role changes. An unplanned raise to Administrator should page someone.
Try it yourself
Check one remote access appliance: who can reach its admin page, which roles can raise roles, and whether role changes alert.
Click through it at your own pace, or open it full screen.
Quick check
Why not rotate credentials immediately?
GTIG says rotating before patching or rebuilding exposes the new credentials to an attacker who still controls the appliance.
Is the attribution certain?
No. GTIG calls the actor suspected PRC-nexus, based on tooling and techniques that match earlier activity.
