--- title: BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs description: A China-nexus threat group dubbed Armory Castle (formerly UNC5221/UTA0178) exploited a critical zero-day in BeyondTrust Remote Support, CVE-2026-102764 (CVSS... canonical: https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs | daily.dev og:description: A China-nexus threat group dubbed Armory Castle (formerly UNC5221/UTA0178) exploited a critical zero-day in BeyondTrust Remote Support, CVE-2026-102764 (CVSS... og:url: https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn og:image: https://api.daily.dev/og/posts/VT69o6gMN.png og:image:alt: BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A China-nexus threat group dubbed Armory Castle (formerly UNC5221/UTA0178) exploited a critical zero-day in BeyondTrust Remote Support, CVE-2026-102764 (CVSS 9.3), starting Aug. 29, 2026, deploying a custom PHP webshell called SAWFLY within 11 minutes of weaponizing the bug. Attackers raided the appliance's secrets vault, dumped admin credentials, escalated privileges, wiped logs, and used a new SOCKS5 tunneling tool called BARECLAW to exfiltrate data. BeyondTrust patched on Oct. 9 and urged urgent updates. This follows a week of other actively exploited edge vulnerabilities in Ivanti Connect Secure, Cisco Secure Email Gateway, and Palo Alto Networks PAN-OS, prompting Mandiant/GTIG to recommend patching, isolation, and compensating controls like WAFs and external credential vaults. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-102764 in BeyondTrust Remote Support? It is a critical vulnerability in BeyondTrust Remote Support with a CVSS score of 9.3, caused by an internal messaging component failing to validate the origin of incoming messages. A China-nexus actor tracked as Armory Castle (formerly UNC5221/UTA0178) exploited it as a zero-day starting August 29, 2026. BeyondTrust released a patch on October 9. _Teams patching remote access appliances can track fast-moving edge CVEs like this one on daily.dev._ ### How did the Armory Castle threat actor use the BeyondTrust vulnerability after exploiting it? The group deployed a custom PHP webshell called SAWFLY just 11 minutes after weaponizing the flaw, then raided the appliance's built-in secrets vault for passwords, API keys, and endpoint credentials before dumping all admin credentials. It deleted logs, escalated to full admin privileges, performed internal reconnaissance, exfiltrated documents, and used a new SOCKS5 tunneling tool called BARECLAW for downstream access. _Incident responders tracking fast post-exploitation playbooks follow threat actor research like this through daily.dev._ ### How many BeyondTrust Remote Support instances were exposed to the internet before the recent exploitation? Earlier research found around 11,000 Remote Support instances exposed to the internet across cloud and on-premises deployments, following discovery of a separate 9.9 CVSS pre-authentication flaw in Remote Support and its companion product Privileged Remote Access. BeyondTrust says it serves over 20,000 customers including 75 of the Fortune 100, though exact Remote Support adoption numbers remain unclear. _Security teams assessing exposure of remote access tools can keep tabs on these findings via daily.dev._ ## Similar posts on daily.dev - [BeyondTrust warns of critical flaws in remote access software](https://daily.dev/posts/beyondtrust-warns-of-critical-flaws-in-remote-access-software-j3jfbhals) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs","url":"https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn"},"datePublished":"2026-10-16T20:58:18.103Z","dateModified":"2026-10-16T20:59:32.626Z","description":"A China-nexus threat group dubbed Armory Castle (formerly UNC5221/UTA0178) exploited a critical zero-day in BeyondTrust Remote Support, CVE-2026-102764 (CVSS...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4407e5d7f70f8dd76fc58cf1d67a4474?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4407e5d7f70f8dd76fc58cf1d67a4474?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"BeyondTrust Zero-Day Continues Trend of Exploited Edge Bugs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/beyondtrust-zero-day-continues-trend-of-exploited-edge-bugs-vt69o6gmn#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-102764 in BeyondTrust Remote Support?","acceptedAnswer":{"@type":"Answer","text":"It is a critical vulnerability in BeyondTrust Remote Support with a CVSS score of 9.3, caused by an internal messaging component failing to validate the origin of incoming messages. A China-nexus actor tracked as Armory Castle (formerly UNC5221/UTA0178) exploited it as a zero-day starting August 29, 2026. BeyondTrust released a patch on October 9. Teams patching remote access appliances can track fast-moving edge CVEs like this one on daily.dev."}},{"@type":"Question","name":"How did the Armory Castle threat actor use the BeyondTrust vulnerability after exploiting it?","acceptedAnswer":{"@type":"Answer","text":"The group deployed a custom PHP webshell called SAWFLY just 11 minutes after weaponizing the flaw, then raided the appliance's built-in secrets vault for passwords, API keys, and endpoint credentials before dumping all admin credentials. It deleted logs, escalated to full admin privileges, performed internal reconnaissance, exfiltrated documents, and used a new SOCKS5 tunneling tool called BARECLAW for downstream access. Incident responders tracking fast post-exploitation playbooks follow threat actor research like this through daily.dev."}},{"@type":"Question","name":"How many BeyondTrust Remote Support instances were exposed to the internet before the recent exploitation?","acceptedAnswer":{"@type":"Answer","text":"Earlier research found around 11,000 Remote Support instances exposed to the internet across cloud and on-premises deployments, following discovery of a separate 9.9 CVSS pre-authentication flaw in Remote Support and its companion product Privileged Remote Access. BeyondTrust says it serves over 20,000 customers including 75 of the Fortune 100, though exact Remote Support adoption numbers remain unclear. Security teams assessing exposure of remote access tools can keep tabs on these findings via daily.dev."}}]} ```