Armory Castle Exploits BeyondTrust CVE-2026-102764 Zero-Day for Root Access and Lateral Movement

The technical evidence shows selective zero-day use followed by broad scanning once disclosed. Armory Castle previously chained Citrix NetScaler CVE-2023-4966 and Ivanti Connect Secure CVEs 2023-46805 2024-21887 2025-0282 against legal SaaS and government targets since October 2023. Mandiant telemetry confirms post-compromise steps including copying /bin/sh to /usr/bin/dbus-authd setting SUID root then pivoting via compromised admin accounts. BeyondTrust advisory notes the actor maintains AI-modeled product instances for rapid exploit chaining.

Official attribution labels the group China-nexus without independent packet or infrastructure confirmation. The evidence trail consists of SAWFLY web shell deployment commercial VPN exit nodes and router compromise for C2 blending. No public IOC overlap with PRC state infrastructure has been released. This matches prior UNC5221 patterns but lacks the multi-vector attribution data seen in documented Volt Typhoon operations.

The operational pattern reveals sustained targeting of remote support and VPN appliances as high-value chokepoints. Unpatched self-hosted instances from versions 24.3.1 to 26.2.3 remain exposed after the October 9 SaaS patch rollout. Similar appliances continue to serve as initial access vectors for downstream credential theft and lateral movement across multiple sectors.

Next expected activity is mass exploitation of remaining unpatched BeyondTrust instances within 30 days of disclosure mirroring the post-Ivanti surge. Procurement records for equivalent remote access tools should be reviewed for equivalent exposure.