OTX Threat: ARMORY CASTLE Exploits BeyondTrust

On October 15, BeyondTrust disclosed CVE-2026-102764, a vulnerability affecting BeyondTrust Remote Support appliances that enables arbitrary file upload. Mandiant identified ARMORY CASTLE, a suspected PRC-nexus espionage actor, exploiting this as a zero-day in late August 2026. Following exploitation, the actor deployed SAWFLY webshell and BARECLAW tunneler, escalated privileges using SUID bit man CVEs: CVE-2023-46805, CVE-2024-21887, CVE-2026-102764