By {"$":{"xmlns:author":"http://www.w3.org/2005/Atom"},"company":[""],"department":[""],"name":["Google Threat Intelligence Group "],"title":[""]}
RedisAWSAzureSecurity
AI summary
Mandiant analyzed the post-exploitation TTPs of the threat actor ARMORY CASTLE after they utilized CVE-2026-102764 as a zero-day to compromise BeyondTrust Remote Support appliances. The analysis outlines how the actor established persistence through custom malware, specifically the SAWFLY webshell and BARECLAW tunneler, while utilizing internal appliance utilities to evade detection.
Key points
Threat actors may leverage deep knowledge of proprietary appliance internals, such as CLI utilities and startup templates, to maintain persistent access.
Detection of unauthorized file uploads and post-exploitation activity often requires access to restricted or encrypted system partitions like LUKS-encrypted directories.
Effective hunting for sophisticated backdoors, like BARECLAW, involves identifying specific obfuscation patterns and binary string signatures.
Log deletion and the removal of endpoint artifacts are standard indicators of an active threat actor attempting to evade detection during persistence phases.
