ARMORY CASTLE Exploits BeyondTrust
Mandiant analyzed the post-exploitation TTPs of the threat actor ARMORY CASTLE after they utilized CVE-2026-102764 as a zero-day to compromise BeyondTrust Remote Support appliances. The analysis outlines how the actor established persistence through custom malware, specifically the SAWFLY webshell and BARECLAW tunneler, while utilizing internal appliance utilities to evade detection.