Names
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| ARMORY CASTLE | Name used in the GTIG report of 15 October 2026[1] |
| UNC5221 | Earlier GTIG and Mandiant name, used in the 2025 reports on Ivanti flaws and BRICKSTORM. The US Department of Justice (5 March 2025) writes "UNC 5221" among the names of APT27; see the APT27 profile[1, 4, 5, 6] |
Who says so
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
-
Google Threat Intelligence Group 15 October 2026
Attributes the zero-day exploitation of CVE-2026-102764 and the use of SAWFLY and BARECLAW to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221. It says the tools and methods match earlier ARMORY CASTLE activity.[1]
-
Google Threat Intelligence Group 15 October 2026
Assesses with high confidence that the group will keep using zero-day flaws in edge devices to support espionage.[1]
-
Google Threat Intelligence Group (Mandiant) 24 September 2025
Tracks BRICKSTORM backdoor activity in the United States since March 2025 and ties it to UNC5221 and closely related, suspected China-nexus clusters.[6]
-
Google Threat Intelligence Group (Mandiant) 3 April 2025
Attributes the Ivanti Connect Secure zero-day exploitation of CVE-2025-22457 and the SPAWN malware to UNC5221, a suspected China-nexus espionage actor.[4]
-
Google Threat Intelligence Group (Mandiant) 8 January 2025
Attributes the Ivanti Connect Secure zero-day exploitation of CVE-2025-0282 to UNC5221 and says it merged UNC5337 into UNC5221.[5]
-
CISA 16 October 2026
Says "cyber threat actors" are exploiting CVE-2026-102764 and names no group in the alert text. The alert links to a BeyondTrust blog whose title uses the name ARMORY CASTLE.[2]
-
Canadian Centre for Cyber Security 16 October 2026
Says open-source reporting indicates exploitation of CVE-2026-102764 and names no group in the alert text. One of its references is the GTIG report.[3]
Where sources differ
Only security company research ties the group to China. GTIG calls it suspected PRC-nexus. CISA and the Canadian Cyber Centre name no actor for the BeyondTrust flaw. CISA, the NSA and the Cyber Centre say in a BRICKSTORM report that PRC state-sponsored actors use that backdoor, but the text does not name UNC5221 or ARMORY CASTLE.
GTIG also notes that UNC5221 has been used as a synonym for the actor publicly called Silk Typhoon, and says it does not currently consider the two the same. The US Department of Justice (5 March 2025) lists UNC 5221 among the names of APT27, so the name also appears on that profile.
Who they target
Sectors
- Ivanti Connect Secure, BeyondTrust Remote SupportGTIG says the actor exploits zero-day flaws in these devices, which often cannot run endpoint security tools.[1, 4, 5, 6]
- Many countries and verticalsGTIG says the group has targeted a wide range of countries and sectors.[1, 5]
- United StatesGTIG says BRICKSTORM intrusions since March 2025 hit legal services, mainly to gather information on US national security and international trade.[6]
- United StatesGTIG assesses with high confidence that the aim is access to downstream customer environments and the data providers host.[6]
- United StatesGTIG lists these providers among the sectors affected by BRICKSTORM intrusions.[6]
- United StatesGTIG says targeting technology firms may support theft of intellectual property to build zero-day exploits.[6]
- VMware vCenter and ESXiGTIG says the group consistently targets vCenter and ESXi hosts, often after first holding an edge appliance.[6]
Operations timeline
Each entry is attributed to the group by the sources cited.
- October 2023
Earliest activity
GTIG says ARMORY CASTLE has been active as early as October 2023.[1]
- December 2023
Ivanti Connect Secure flaws
Mandiant says UNC5221 exploited CVE-2023-46805 and CVE-2024-21887 as early as December 2023.[5]
- 10 January 2024
Ivanti disclosure, then wide exploitation
After the two Ivanti flaws were disclosed, Mandiant observed widespread exploitation by UNC5221 across many countries and sectors.[5]
- Mid-December 2024
CVE-2025-0282 zero-day
Mandiant identified zero-day exploitation of CVE-2025-0282 in Ivanti Connect Secure from mid-December 2024. It reported this on 8 January 2025 and attributed it to UNC5221.[5]
- Mid-March 2025
CVE-2025-22457 exploitation
Mandiant dates the earliest exploitation of this Ivanti flaw to mid-March 2025. Ivanti disclosed it on 3 April 2025, and Mandiant attributed it to UNC5221.[4]
- March 2025
BRICKSTORM intrusions begin
GTIG says Mandiant has responded to BRICKSTORM intrusions in the United States since March 2025.[6]
- 24 September 2025
BRICKSTORM report
GTIG reports an average of 393 days of undetected access in these intrusions and ties the backdoor to UNC5221 and related clusters.[6]
- Late August 2026
BeyondTrust zero-day
GTIG says Mandiant found evidence in an incident response case that ARMORY CASTLE exploited CVE-2026-102764 as a zero-day.[1]
- 9 October 2026
SaaS tenants patched
The Canadian Cyber Centre says BeyondTrust patched all Remote Support SaaS customers by this date.[3]
- 15 October 2026
- 16 October 2026
Government actions
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 4 December 2025 | CISA, NSA and Canadian Cyber Centre | Malware analysis reportReport AR25-338A on the BRICKSTORM backdoor, which the agencies say PRC state-sponsored actors use for long-term access. Updated 11 February 2026. The text does not name UNC5221.[7] |
| 16 October 2026 | CISA | Alert and KEV listingUrged patching of CVE-2026-102764 and added it to the Known Exploited Vulnerabilities catalog.[2] |
| 16 October 2026 | Canadian Cyber Centre | Alert AL26-025Urged upgrading and applying the BT26-05-RS patch.[3] |
How they get in
Techniques reported for this group, by MITRE ATT&CK tactic.
Initial Access
Persistence
-
Server Software Component: Web Shell T1505.003
Drops the SAWFLY web shell in the appliance web root. In the Ivanti cases GTIG names the LIGHTWIRE web shell.[1, 5]
-
Boot or Logon Initialization Scripts T1037
Creates a script in the appliance startup directory so the sudo change survives reboots and configuration resets.[1]
-
Account Manipulation T1098
Raises the permissions of a compromised account from No Access to Administrator for Jump Items and Teams.[1]
Privilege Escalation
-
Abuse Elevation Control Mechanism: Setuid and Setgid T1548.001
Copies the system shell to a new file, makes root the owner and sets the SUID bit, giving a root backdoor.[1]
-
Abuse Elevation Control Mechanism: Sudo and Sudo Caching T1548.003
Adds a passwordless sudo entry for the site service account to the appliance sudoers template.[1]
Defense Evasion
Credential Access
Lateral Movement
Collection
Tools and malware
-
SAWFLY Web shell
PHP web shell (mangoapi.php) with RC4 encrypted, Base32 encoded commands; one of the group's main footholds on the BeyondTrust appliance (2026).[1]
-
BARECLAW Tunneler
C program that carries a SOCKS5 proxy over WebSocket and was exposed through a changed reverse proxy setting (2026).[1]
-
BRICKSTORM Backdoor
Go backdoor with SOCKS proxy function, found on Linux and BSD based appliances and tied by GTIG to UNC5221 (2025).[6]
-
BRICKSTEAL Credential stealer
Malicious servlet filter that captures vCenter logins, tracked by Mandiant in BRICKSTORM intrusions (2025).[6]
-
TRAILBLAZE Dropper
In-memory dropper used with the Ivanti flaw CVE-2025-22457 (2025).[4]
-
BRUSHFIRE Backdoor
Passive backdoor injected into a running web process on Ivanti Connect Secure (2025).[4]
-
SPAWN Malware family
Ecosystem of SPAWNANT installer, SPAWNMOLE tunneler and SPAWNSNAIL SSH backdoor, now attributed to UNC5221 (2025).[4, 5]
-
ZIPLINE Backdoor
Passive backdoor used after the first Ivanti flaws (2024).[5]
-
THINSPOOL Dropper
Dropper used after the first Ivanti flaws (2024).[5]
-
LIGHTWIRE Web shell
Web shell used after the first Ivanti flaws (2024).[5]
-
WARPWIRE Credential harvester
Credential harvester used after the first Ivanti flaws (2024).[5]
Also linked in our threat library:
Vulnerabilities exploited
Detection and defense
-
Patch the appliance
Apply BT26-05-RS to self-hosted Remote Support on versions 24.3.1 to 26.2.3. Older versions must be upgraded first. SaaS tenants are already patched.
-
Shrink the exposure
Allow outside access only to the services users need and keep the /login and /appliance admin pages on trusted networks.
-
Keep logs off the box
Forward appliance syslog and session events to your SIEM and keep web application firewall and proxy logs, because the group deletes local logs.
-
Rotate what the appliance held
After the appliance is patched or rebuilt, revoke active support sessions and rotate every credential it stored or injected, starting with admin and vault credentials. GTIG warns that rotating earlier exposes the new credentials to an attacker who still controls the appliance.
Counters T1555
-
Check role changes
Look for Jump Item roles raised to Administrator and other unauthorized account, permission or session policy changes.
-
Hunt for the traces
Look for unrecognized privileged sessions, unrecognized script files and unexpected gaps in logs or log forwarding.
Counters T1505.003
-
Inventory edge devices
List every edge and remote access appliance and monitor traffic coming from them, since they often have no endpoint agent.
What Brandefense can do
- External Attack Surface Management
Find remote access and VPN appliances that face the internet and check which versions they run, so the patch queue starts with them.
- Cyber Threat Intelligence
Follow reports on edge device zero-days and get an alert when a product you run is named.
- Dark Web Monitoring
Watch for company credentials that show up on criminal forums after an appliance compromise.
Frequently Asked Questions
Who is ARMORY CASTLE?
A suspected China-nexus espionage actor, according to Google Threat Intelligence Group. It is the new name for the cluster GTIG formerly tracked as UNC5221.
Did a government name ARMORY CASTLE?
Not in the sources we reviewed. CISA and the Canadian Cyber Centre alerts on the BeyondTrust flaw speak of cyber threat actors or open-source reporting and name no group.
Which BeyondTrust flaw did it use?
CVE-2026-102764 in Remote Support. GTIG says the group used it as a zero-day from late August 2026, before BeyondTrust disclosed it on 15 October 2026.
What tools did it use in that attack?
A web shell called SAWFLY and a tunneler called BARECLAW, both named by GTIG as new custom malware. It also used the appliance's own utilities.
Which other products did it use before?
Ivanti Connect Secure, per Mandiant, from December 2023 to 2025. GTIG also ties the BRICKSTORM backdoor to UNC5221.
What should I do first?
Patch with BT26-05-RS, treat any appliance that was exposed while unpatched as possibly compromised, rebuild it from a clean image and rotate the credentials it held.
Sources
- ARMORY CASTLE Exploits BeyondTrustGoogle Threat Intelligence Group (Mandiant) · Supports: 15 October 2026 report: zero-day use of CVE-2026-102764, SAWFLY and BARECLAW, attribution to ARMORY CASTLE, former name UNC5221, activity since October 2023
- CISA Urges Patching Critical Vulnerability in BeyondTrust Remote SupportCISA · Supports: 16 October 2026 alert: active exploitation by "cyber threat actors", KEV listing, no group named
- AL26-025 Critical vulnerability impacting BeyondTrust Remote Support (CVE-2026-102764)Canadian Centre for Cyber Security · Supports: 16 October 2026 alert: open-source reporting of exploitation, SaaS patched by 9 October 2026, no group named
- Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)Google Threat Intelligence Group (Mandiant) · Supports: 3 April 2025: UNC5221 attribution, TRAILBLAZE, BRUSHFIRE, SPAWN, zero-day use of edge devices back to 2023
- Ivanti Connect Secure VPN Targeted in New Zero-Day ExploitationGoogle Threat Intelligence Group (Mandiant) · Supports: 8 January 2025: CVE-2025-0282, UNC5221 attribution, earlier Ivanti flaws from December 2023, custom tools, UNC5337 merged into UNC5221
- Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal SectorsGoogle Threat Intelligence Group (Mandiant) · Supports: 24 September 2025: BRICKSTORM backdoor, sectors hit, 393 day average dwell time, difference from Silk Typhoon
- BRICKSTORM Backdoor (AR25-338A)CISA, NSA and Canadian Centre for Cyber Security · Supports: 4 December 2025 (updated 11 February 2026): PRC state-sponsored actors use BRICKSTORM; no group name in the text
- Exploit Public-Facing Application, Technique T1190MITRE ATT&CK · Supports: Technique id and name
