Armory Castle exploits BeyondTrust zero-day CVE-2026-102764 to harvest appliance credentials

BeyondTrust disclosed CVE-2026-102764 after Mandiant and Google Threat Intelligence Group flagged active exploitation. The flaw allowed unauthenticated attackers to access stored credentials and modify persistent files on internet-facing appliances. Patches and mitigations were released, yet Mandiant assessed any reachable device as potentially compromised until forensic review. Attackers deployed custom Sawfly and Bareclaw malware that survived reboots and configuration resets.

Evidence shows the group leveraged proprietary appliance internals knowledge, consistent with prior campaigns against Ivanti and Citrix products. Mandiant documented selective zero-day use followed by mass exploitation after disclosure, including turning a low-risk Ivanti patch into remote code execution. Google GTIG linked the same actor to opportunistic scanning across legal, SaaS, and technology sectors since October 2023.

The pattern reveals a deliberate pipeline: compromise edge devices to map internals, extract zero-days for future use, then pivot to high-value targets. Official statements label Armory Castle as Chinese state-sponsored espionage focused on long-term collection; technical indicators confirm TTPs and tooling but do not independently verify state attribution beyond observed infrastructure overlap.

Next steps include monitoring for post-patch mass scanning within 14 days and auditing logs for Sawfly persistence artifacts on all exposed appliances. Organizations should assume breach until credential rotation and appliance replacement occur.