Cyber Threat Brief — October 16 2026
⚠️ This report is AI-generated. Always validate findings.
1. BeyondTrust Remote Support — zero-day used by Armory Castle to root appliances — CVE-2026-102764
TL;DR: Mandiant says the China-nexus espionage group Armory Castle (formerly UNC5221) exploited an unauthenticated file-write bug in BeyondTrust Remote Support from late August, then rooted the appliance, dumped its credential vault, and used admin sessions to reach internal endpoints. Apply the BT26-05-RS patch on every self-hosted appliance today and treat any appliance that was internet-facing before the patch as compromised until reviewed.
What’s New:
- CVE-2026-102764 (CVSSv4 9.3, CWE-290) is an origin-validation flaw in an internal messaging component that lets an unauthenticated attacker perform file operations on Remote Support 26.2.3 and earlier. SaaS tenants were patched Oct 8–9; self-hosted appliances on 24.3.1–26.2.3 need BT26-05-RS, and older versions must upgrade first. Privileged Remote Access shares the code and has its own patch, though BeyondTrust found no exploit path there.
- BeyondTrust says the first exploitation was Aug 29, against one BeyondTrust-hosted instance and one self-hosted appliance. Its own sensors fired when the attacker escalated privileges, but its vendor’s automated triage closed the alerts as false positives.
- Mandiant warns Armory Castle has historically switched to mass exploitation right after disclosure, as it did with Ivanti in 2024. Shadowserver sees about 1,400 internet-facing Remote Support instances.
- Not in KEV as of catalog 2026.10.15. BeyondTrust is withholding exploit details, and no public PoC exists.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| BeyondTrust Remote Support 26.2.3 or earlier without the BT26-05-RS patch | Vulnerable version | T1190 | /appliance interface / asset inventory | Apply BT26-05-RS from the /appliance interface, or confirm automatic updates installed it. Appliances older than 24.3.1 must upgrade first; also patch self-hosted Privileged Remote Access. Patching does not undo a compromise. |
HTTP POST to /app_84304470%2Ephp | Exploit staging request | T1190 | Reverse proxy / WAF access log in front of the appliance | Search proxy and WAF logs back to Aug 29 for this path. A hit marks the start of the intrusion; preserve the appliance before changing anything. |
HTTP POST to mangoapi.php (SAWFLY web shell) carrying body parameter _c94mfe | Web shell traffic | T1505.003 | Reverse proxy / WAF access log | Alert on any request to mangoapi.php or to any .php path outside the normal Remote Support path set. SAWFLY returns 404 unless _c94mfe is present, so a 200 response to a POST means a working shell. |
SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb | File hash (SAWFLY, mangoapi.php) | T1505.003 | Forensic image of the appliance / threat-intel blocklist | Add the hash to blocklists and scan any preserved image with Mandiant’s YARA rule G_Hunting_Webshell_SAWFLY_1. Customers cannot scan the appliance file system themselves, so request preservation through BeyondTrust Support. |
SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462 | File hash (BARECLAW tunneler, /tmp/ingredi_ws) | T1572 | Forensic image / threat-intel blocklist | Add the hash to blocklists and scan preserved images with YARA rule G_Hunting_Backdoor_BARECLAW_1. It was run as /tmp/ingredi_ws --listen 19800 --obfs -q --ws-path /uidchanarge. |
Request or WebSocket upgrade to URI /uidchanarge | Tunnel C2 | T1572 | Reverse proxy / WAF / perimeter firewall logs | Alert on any request to /uidchanarge and on WebSocket upgrades to the appliance from outside your support-staff and endpoint ranges. The attacker added an HAProxy rule (acl wswsws path /uidchanarge, backend webskd3 to 127.0.0.1:19800) to publish the tunnel through the appliance’s normal HTTPS port. |
BeyondTrust syslog user_changed event where jump_item_role moves from No Access to Administrator | Permission abuse | T1098 | BeyondTrust appliance syslog in SIEM | Alert on user_changed events that raise a Jump Item or team role, and on user_added, api_account, or security_provider changes without a ticket. Then review that account’s support sessions and file transfers to scope which endpoints were touched. |
BeyondTrust syslog event=login, status=success, target=web/login from residential broadband or commercial VPN address space | Valid account abuse | T1078 | BeyondTrust appliance syslog / IP enrichment | Alert on /login successes from consumer ISP or VPN ranges and outside business hours. BeyondTrust says the operator routes through VPN exits and hacked home routers. |
/ns/sbin/bt-secrets get vault (and get -p <site account> vault) in the appliance messages log | Credential vault dump | T1555 | BeyondTrust syslog / preserved /var/log/messages | Search forwarded logs for bt-secrets. Any hit means every credential the appliance stored or injected is exposed; rotate them only after the appliance is patched or rebuilt. |
| Gap in syslog forwarding from the appliance that starts and ends within one session | Log deletion | T1070.002 | SIEM ingestion health for the appliance source | Alert when the appliance goes silent for longer than its normal interval. The actor deleted /ns/log/*.log, /var/log/messages, and bt-secrets.log, so off-box logs are the only reliable record. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | BeyondTrust appears only in the generic Windows RMM-tool rule; nothing ingests Remote Support appliance syslog or web logs. |
| Elastic | None — verified | BeyondTrust is listed only in RMM-software rules for Windows endpoints. Linux SUID and sudoers rules need host telemetry the closed appliance does not provide. |
| Sigma | None — verified | The only BeyondTrust mention is an Okta support-breach rule; no rule covers the appliance. |
Detection index: ESCU 12b9d52 (2026-10-16) · elastic detection-rules 7fc474b (2026-10-16) · SigmaHQ 7d8b152 (2026-10-14).
Hunt hint: You cannot see inside the appliance, so hunt from what surrounds it. Pull reverse-proxy, WAF, and firewall logs for the appliance address back to Aug 29 and look for /app_84304470%2Ephp, mangoapi.php, /uidchanarge, and any other unknown .php path. In forwarded syslog, look for Jump Item roles raised to Administrator, /login from consumer or VPN space, and bt-secrets commands. On-box persistence (an SUID root copy of /bin/sh at /usr/bin/dbus-authd and /home/bomgar/sbin/post_boot.d/zz-root-persist, which adds NOPASSWD: ALL to /ns/config/sudoers.template) survives reboot and configuration reset, so any appliance with a hit should be imaged and rebuilt rather than cleaned.
Sources: BeyondTrust advisory BT26-05 · BeyondTrust blog · Mandiant / GTIG: ARMORY CASTLE Exploits BeyondTrust · GTIG frontline intel lead on X · BleepingComputer · SecurityWeek
2. FortiGate PEERSTITCH implant — FortiOS auto-script path traversal to root — CVE-2025-61624
TL;DR: Unit 42 found a memory-only implant, PEERSTITCH, inside the logging and VPN daemons of FortiGate firewalls at a telecom managed service provider. The attackers first stole configurations for 500+ firewalls from a FortiManager, then used admin access plus a FortiOS CLI path traversal to get root. Fortinet now marks CVE-2025-61624 as known exploited. Upgrade FortiOS and audit every firewall’s system auto-script objects for ../ names.
What’s New:
- CVE-2025-61624 (CVSS 6.5, CWE-22) lets any admin with read-write rights name an auto-script with
../sequences and write it anywhere as root. Fortinet patched it in April (FG-IR-26-122) and has since flipped the advisory to “Known Exploited: Yes”. It is not in CISA KEV. - Initial access was FortiJump (CVE-2024-47575, KEV since 2024) against the provider’s FortiManager in September 2024. The stolen archive held reversibly encrypted admin and SSL VPN passwords, which Unit 42 confirmed could be cracked, plus the trust material for every managed firewall.
- PEERSTITCH (
lldprx, ARM64) uses ptrace to hook/bin/miglogdand/bin/iked, then deletes itself. VPN sessions it has tagged skip FortiOS security checks. A second backdoor abused Apachemod_mdACME renewal to run an SSH reverse shell. - Unit 42 tracks the cluster as CL-STA-0954 (UNC5820) and notes overlap with nation-state tradecraft. If FortiManager trust material was stolen, it stays valid until rotated, even after patching.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9, or any 7.2, 7.0, or 6.4 build | Vulnerable version | T1068 | FortiGate inventory (get system status) / FortiManager device list | Upgrade to 7.6.5 or 7.4.10 or later; 7.2, 7.0, and 6.4 must migrate to a fixed train. Also patch FortiProxy (7.6.5 / 7.4.12), FortiSwitchManager (7.2.8 / 7.0.7), and FortiPAM (1.7.1). |
config system auto-script entry whose name contains ../ (seen: ../../../../setup) | Exploit artifact | T1068 | FortiGate config revisions / event log (cfgpath="system.auto-script") | Run show system auto-script on every FortiGate and diff config revisions back to 2024 for any auto-script name with ../. Alert on new auto-script objects. The attackers deleted these objects shortly after use, so check revision history, not just the running config. |
Auto-script named ../../tmp/apache2/conf/md-acme.conf | ACME reverse-shell backdoor | T1059 | FortiGate config revisions / event log | Search revisions for this name. On any hit, treat the firewall as root-compromised; the file pointed Apache’s ACME client at 23.240.77.233:8084 and mapped the DNS-01 challenge to /bin/node to launch SSH. |
Source IP 23.240.77[.]233 | IOC | T1105 | Firewall traffic log / SSL VPN event log | Block and search for 23.240.77.233 as an SSL VPN login source and as a destination on TCP 8084/8085 (stager /pM.js, rogue ACME /directory). Any successful VPN login from it means the account’s password came from a stolen config. |
Source IP 47.18.167[.]159 | IOC | T1105 | Firewall traffic log / SSL VPN event log | Block and search for 47.18.167.159 as an SSL VPN source and as a destination on TCP 8085 (/pM.js). |
Source IP 45.32.41[.]202 | IOC | T1190 | FortiManager event log / firewall log for TCP 541 | Block and search FortiManager logs and TCP 541 traffic for 45.32.41.202; it registered a rogue virtual FortiGate named localhost (serial FMG-VMTM23017412). |
Source IP 198.199.122[.]22 | IOC | T1190 | FortiManager event log / firewall log for TCP 541 | Block and search for 198.199.122.22, the second address used for the rogue localhost device. |
Admin account FortiGateCloud downloading running configurations on a firewall with no FortiGate Cloud enrollment | Management impersonation | T1602.002 | FortiGate event log (config download events) | Alert on any FortiGateCloud login or config download where you have no FortiGate Cloud tenant. Unit 42 assesses the attacker impersonated FortiManager over FGFM (TCP 541) using stolen trust material. |
| New packet-capture (sniffer) profile capturing UDP 69, UDP 1812/1813, or TCP 389 | Credential interception | T1040 | FortiGate config revisions / FortiManager change log | Review config history for sniffer profiles you did not create, especially TFTP, RADIUS, and LDAP captures, and pushes to TCP ports 3696–3706. |
diagnose debug crashlog read showing Signal 11 crashes in miglogd, iked, or syslogd | Injection side effect | T1055.008 | FortiGate CLI crash log | Run the command on each firewall and investigate Signal 11 crashes in those daemons; the attackers ran diagnose debug crashlog clear afterwards, so an empty log right after a known gap is also suspicious. |
SHA-256 b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 | File hash (PEERSTITCH lldprx injector) | T1055.008 | Threat-intel blocklist / Fortinet TAC forensic image | Add the hash to blocklists and scan any image of /data2/template/ (lldprx, ipssem.js, index.js, index.wasm, pM.js) with Unit 42’s YARA rule u42_apt_linux_PEERSTITCH_fortigate_implant. Memory checks (16 KB rwxp maps in miglogd/iked) need Fortinet TAC. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | The only FortiGate rule (Fortinet Appliance Auth bypass) looks for REST API /api/v2/cmdb/system/admin requests in web data, not CLI auto-scripts. |
| Elastic | Partial — FortiGate Configuration File Downloaded | Fires on config-download events (event.code 0100032095, action download), which covers the FortiGateCloud config pulls; nothing sees auto-script traversal or the in-memory hooks. |
| Sigma | Partial — FortiGate - New Administrator Account Created | Fires on cfgpath: system.admin adds, which would catch the short-lived rogue admins Unit 42 describes; no rule covers auto-script objects. |
Detection index: ESCU 12b9d52 (2026-10-16) · elastic detection-rules 7fc474b (2026-10-16) · SigmaHQ 7d8b152 (2026-10-14).
Hunt hint: Start with FortiManager, because one compromised manager exposes every firewall it manages. Check its device list for a localhost virtual FortiGate and its logs for the four published IPs. On each FortiGate, pull config revision history and search for auto-script names containing ../, sniffer profiles you did not create, and admin or VPN groups that appear and vanish within hours. Then run diagnose debug crashlog read and look for miglogd or iked segfaults. If anything hits, rotate every admin and SSL VPN password and the FortiManager trust material, not just the firmware.
Sources: Unit 42: PEERSTITCH · Unit 42 on X · Fortinet PSIRT FG-IR-26-122 · The Hacker News
Status Updates
- CVE-2026-104935 (Ivanti Connect Secure): KEV due today, Oct 16. The privilege-escalation link in UTA0576’s chain is still unpatched. Original brief.
- CVE-2026-96951 (Windows Shell MotW bypass): KEV due today, Oct 16; still no public IOCs or attribution. Original brief.
- CVE-2026-21589 (Atlassian Data Center file read): CISA added it to KEV on Oct 15 (due Oct 18, forensic triage required). Hunt for
..::sequences such as..::..::WEB-INF::web.xmlin Jira, Confluence, Bitbucket, Bamboo, and Crowd access logs. Original brief. - CVE-2026-0322 (PAN-OS management interface): PAN-OS 11.2.16 shipped Oct 15, so every supported train now has a fixed build. KEV due tomorrow, Oct 17. Original brief.
- CVE-2026-76519 (Cisco Secure Email Gateway): KEV due tomorrow, Oct 17; Cisco has added no attack IOCs. Original brief.
- CVE-2026-105133 / CVE-2026-105134 (AhsayCBS): Horizon3 published a working PoC and writeup on Oct 15. Hunt for JSON API requests containing
"FromServlet":"Y"and forPUT /rps/obs7/rpsfile/uploadwith../in theUserHomeorTopDirheader. Bitdefender MDR reports three more incidents and C238.60.252[.]110. KEV due Oct 17. Original brief. - KEV deadlines passed: CVE-2026-86950 (Apple CoreGraphics, due Oct 13) (brief); the Flax Typhoon set CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894 (due Oct 11) (brief); CVE-2026-0257 (Palo Alto GlobalProtect) (brief).
- Retired from watch: SonicWall SMA1000 CVE-2026-83548 and CVE-2026-83549 (last update 2026-10-08, 09-03). The KEV deadline passed Sept 5 and nothing material has changed in eight days.
- Deferred, not yet briefed: Linux kernel “PwnEscape” CVE-2026-99999 (guest-to-host memory leak and lab escape on KVM and Firecracker; fixed in 6.12.113, 6.6.159, 6.1.190, and the other Oct 15 stable kernels; no in-the-wild use) — recheck 2026-10-19. Langflow CVE-2026-105740, SiteGuard CVE-2026-106931, SAP Cloud SDK CVE-2026-89111, and Ghostscript CVE-2026-39919 — recheck 2026-10-17. Dropped: AnyDesk Linux “AnyPwn”, now CVE-2026-109390, still has no in-the-wild use eight days after its public PoC; upgrade Linux AnyDesk to 8.0.3 or later.
- Watching (no change): CVE-2026-110447 Collabora CODE; BleepingComputer could not confirm reports of ransomware use (10-15); CVE-2026-102255 SonicWall SMA1000 SSRF, still not in KEV (10-10); FROMAGEGATE (10-13); GhostAction (10-10); CVE-2026-97229 GitLab (10-13); CVE-2026-85097 and CVE-2026-107406 (10-09); CVE-2026-82077 (10-11); CVE-2026-61500 and CVE-2026-88062 (10-04).