Hunt SAWFLY and BARECLAW on BeyondTrust After CVE-2026-102764

Mandiant published the IOCs. CISA put CVE-2026-102764 on KEV. Your job is not to retweet The Hacker News. Your job is to grep what you can still see, because ARMORY CASTLE deleted a lot of what you cannot. This lab walkthrough turns public SAWFLY, BARECLAW, persistence, and anti-forensics artifacts into terminal greps you can adapt to your SIEM after you patch BT26-05-RS like you meant it.

What you are hunting

CVE-2026-102764 is an unauthenticated file-operation flaw in BeyondTrust Remote Support (<= 26.2.3). Mandiant attributes zero-day exploitation in late August 2026 to ARMORY CASTLE (suspected PRC-nexus, formerly UNC5221). Post-exploitation tooling in the public write-up:

• SAWFLY (mangoapi.php): PHP webshell, POST param _c94mfe, Base32 + RC4, returns 404 without the param. SHA-256 dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb
• BARECLAW (ingredi_ws): SOCKS5-over-WebSocket tunneler. Observed CLI: --listen 19800 --token ... --obfs -q --ws-path /uidchanarge. SHA-256 1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462
• Staging: POST activity to /app_84304470%2Ephp before SAWFLY lands under the site service account’s Laravel public path
• Persistence: /home/bomgar/sbin/post_boot.d/zz-root-persist rewriting sudoers.template; SUID /usr/bin/dbus-authd
• Anti-forensics: bulk rm of /ns/log/*, site httpd logs, /var/log/messages, and bt-secrets.log

Step 1: string and path hunt

cat iocs.txt
grep -E 'mangoapi|app_84304470|_c94mfe|SAWFLY' bt_lab.log

In the lab you should see the staging POST and the SAWFLY hit with _c94mfe. On real gear, widen to reverse-proxy and WAF URI logs. Mandiant stresses that many on-box logs were deleted. Off-box URI history is how you still see mangoapi.php and weird .php staging names after the appliance diary was shredded.

Step 2: tunneler, HAProxy, persistence, vault

grep -E 'ingredi_ws|uidchanarge|BARECLAW|haproxy|zz-root|dbus-authd|bt-secrets' bt_lab.log
awk -F'note=' '/note=/{print $2}' bt_lab.log | sort | uniq -c | sort -rn

BARECLAW in the observed intrusion listened only on localhost:19800. The public face was HAProxy ACL wswsws matching path /uidchanarge and backend webskd3 to 127.0.0.1:19800. External port scans of the appliance will not invent that listener for you. You need config review of haproxy.conf (via Support / forensics) and proxy logs showing that path.

Vault abuse used /ns/sbin/bt-secrets with variations like get -p %SITE_SERVICE_ACCOUNT% vault, get %SITE_SERVICE_ACCOUNT% vault, and get vault, followed by deletion of bt-secrets.log. If you still have forwarded command or messages logs from the window, those strings are tickets. If you do not, assume vault contents are burned and rotate at the targets.

Step 3: hashes, Jump Item roles, syslog gaps

Compare any recovered mangoapi.php or ingredi_ws binaries to Mandiant’s SHA-256 values. Absence of those exact hashes does not mean absence of compromise. Actors rotate builds. Durable signals:

• user_changed events raising Jump Item or team roles to Administrator without a change ticket
• Syslog forwarding gaps bounded by a single session (Mandiant calls this a strong anti-forensics tell)
• Unknown .php under the site Laravel public path; unexpected SUID binaries named like system services
• File-transfer events in support session reports during the exposure window

YARA seeds (from Mandiant, for lab / IR images)

Mandiant published hunting rules G_Hunting_Webshell_SAWFLY_1 and G_Hunting_Backdoor_BARECLAW_1 in the same blog. Use them on forensic images and quaternary storage, not as your only internet-facing WAF rule. SAWFLY’s rule keys on Base32 alphabet, range(0,255), pack('H*',, @eval(, and http_response_code(404) under 20KB. BARECLAW’s rule keys on ELF magic plus CLI help strings like --obfs requires --token and ws_socks5d.

SIEM detections to drop tonight

• Proxy/WAF: mangoapi.php, _c94mfe, /uidchanarge, app_84304470, unknown PHP under Remote Support path sets
• BeyondTrust syslog: Jump Item role elevations; new API accounts; syslog destination changes
• Firewall: appliance egress to unfamiliar destinations after late August 2026; inbound WebSocket upgrades from non-support ranges
• CMDB: Remote Support builds still <= 26.2.3 without BT26-05-RS

What to actually do on real gear

1. Patch BT26-05-RS (upgrade first if older than 24.3.1). Confirm in /appliance.
2. Preserve before panic-reboot: VM snapshot with memory; B Series via Support; export disk.
3. Collect off-box syslog, WAF, reverse-proxy, and perimeter firewall for the full exposure window.
4. If IOC hits or exposure is high: isolate at perimeter, terminate sessions, rebuild from known-good patched image, rotate credentials in Mandiant’s dependency order, redeploy Jump Clients and Jumpoints.
5. Federal scope: KEV due October 19, 2026. Forensic triage required under BOD 26-04 language.

Sloth take

Remote support appliances with public management personality are how the industry cosplays as serious. An unauthenticated file write on that plane, followed by a webshell that 404s scanners and a SOCKS path hiding behind HAProxy, is the encore. Patch the advisory. Grep the Mandiant strings. Put /login and /appliance behind an allow list that requires a second factor and a second thought. Your board slide that says “Secure Remote Access” should not include a footnote that says “admin GUI on the internet, lol.”

Want a careful look at remote-support exposure and log forwarding gaps? Book Dark Edge Consulting.

Mapping exposure before you grep anything

List every Remote Support / Bomgar appliance: SaaS vs self-hosted, version string, internet-reachable admin paths, Jump Client footprint, vault integrations. For each self-hosted face, answer: who can hit /login and /appliance, whether a reverse proxy keeps URI logs the appliance cannot erase, and whether syslog has been leaving the box for months or for three days because someone enabled it after reading a blog.

Then map who holds admin-class credentials and which Jump Items matter. CVE-2026-102764 is pre-auth file ops. Persistence and lateral movement after that are why Jump Item role reviews and session file-transfer reports are part of the same incident as the CVE.

Jump-box and edge pattern that is not theater

• Admin interfaces allow-listed to jump hosts with phishing-resistant MFA
• WAF/reverse proxy with full URI and WebSocket logging retained off-box
• Default-deny appliance egress except vendor update and your syslog/IdP
• Default Jump Item role No Access; grants via policy with tickets
• API accounts scoped and owned; secrets on a rotation calendar

Lab cleanup and false positive notes

Our synthetic log plants Mandiant strings next to RFC 5737 documentation addresses so ranking works. In production, Cloudflare or CDN edges can be noisy. Do not page the planet for a single GET without auth context. Do page for POST with _c94mfe, WebSocket upgrades to /uidchanarge, Jump Item escalations, or syslog gaps correlated with support sessions.

Also remember: absence of the two published hashes does not mean absence of exploitation. Mandiant published a seed set from one intrusion. Your durable controls are patch level, admin exposure, off-box logs, and credential rotation after rebuild.

IR branch if you confirm a hit

1. Isolate inbound at the perimeter firewall; keep appliance config intact for review
2. Preserve snapshots / images before mass reboot-as-coping
3. Assume root: review SUID, post_boot.d, haproxy.conf, sudoers.template, vault state
4. Rebuild from known-good patched image; restore only pre-window config with eyes open
5. Rotate all stored and injected credentials; redeploy Jump Clients, Jumpoints, representative console
6. Hunt every endpoint touched by suspicious support sessions during the window

Proxy log queries that survive appliance amnesia

If your WAF or reverse proxy retains full URIs, search the exposure window for mangoapi.php, percent-encoded staging PHP names, POST bodies or query params referencing _c94mfe, and WebSocket upgrade requests to /uidchanarge. Correlate source IPs with BeyondTrust /login success events and Jump Item file-transfer reports. The appliance may have deleted http-access.log. Your proxy did not get the memo unless the attacker also owned that.

Credential and session report checklist

After patch or rebuild, pull /login session, team activity, and user audit reports for the exposure window. Note every file transfer. Every endpoint in those reports is in scope for downstream hunting. Redeploy Jump Clients and Jumpoints so old tokens die. If Password Safe or PRA integrated with the appliance, rotate at the target systems, not only in the RS UI.

Sources

• Mandiant / Google Cloud Threat Intelligence, “ARMORY CASTLE Exploits BeyondTrust” (Oct 15, 2026)
• BeyondTrust Security Advisory BT26-05 / CVE-2026-102764
• CISA KEV entry CVE-2026-102764 (added 2026-10-16, due 2026-10-19)
• CISA alert on BeyondTrust Remote Support patching (Oct 16, 2026)