Armory Castle chained CVE-2026-102764 zero-day into Sawfly webshell on BeyondTrust RS starting 29 August

The actor gained initial access via the improper message-origin validation flaw, installed the lightweight PHP Sawfly webshell with encrypted C2, escalated to passwordless root on the site service account, then used native file-transfer functions to pull internal documents. Logs at system, web-server and application levels were wiped. Mandiant and GTIG tied the activity to UNC5221/Warp Panda infrastructure and tooling seen in prior edge-device operations.

BeyondTrust detected the flaw on 28 September after public disclosure of the target breach, released a tested patch on 8 October, and applied it to all SaaS instances by 9 October. Self-hosted customers on versions 24.3.1–26.2.3 must apply BT26-05-RS manually; older releases require upgrade first. No independent confirmation of patch completeness against additional exploitation paths has been published.

Armory Castle has repeatedly selected management and VPN appliances for initial access, previously chaining CitrixBleed (CVE-2023-4966), Ivanti Connect Secure flaws (CVE-2023-46805, CVE-2024-21887, CVE-2025-0282) and Dell RecoverPoint (CVE-2026-22769). The consistent focus on devices that provide privileged remote control and limited logging creates durable footholds with minimal external indicators.

Procurement and incident records show continued targeting of SaaS and BPO providers through year-end. Organizations should baseline file-transfer activity and credential use on any remaining unpatched RS appliances; unmonitored self-hosted instances remain the highest-risk population.