Quick links
Press Enter to search, Esc to close
Threat group profile
Google Threat Intelligence Group attributes the zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764), which it dates to late August 2026, to ARMORY CASTLE, a suspected China-linked spying group it formerly tracked as UNC5221.
In short
Google Threat Intelligence Group attributes the zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764), which it dates to late August 2026, to ARMORY CASTLE, a suspected China-linked spying group it formerly tracked as UNC5221. No government has named the group.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| ARMORY CASTLE | Name used in the GTIG report of 15 October 2026[1] |
| UNC5221 | Earlier GTIG and Mandiant name, used in the 2025 reports on Ivanti flaws and BRICKSTORM[1, 4, 5, 6] |
| UNC5337 | Cluster that Mandiant says it merged into UNC5221[5] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
Google Threat Intelligence Group 15 October 2026
Attributes the zero-day exploitation of CVE-2026-102764 and the use of SAWFLY and BARECLAW to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221. It says the tools and methods match earlier ARMORY CASTLE activity.[1]
Google Threat Intelligence Group 15 October 2026
Assesses with high confidence that the group will keep using zero-day flaws in edge devices to support espionage.[1]
Google Threat Intelligence Group (Mandiant) 24 September 2025
Tracks BRICKSTORM backdoor activity in the United States since March 2025 and ties it to UNC5221 and closely related, suspected China-nexus clusters.[6]
Google Threat Intelligence Group (Mandiant) 3 April 2025
Attributes the Ivanti Connect Secure zero-day exploitation of CVE-2025-22457 and the SPAWN malware to UNC5221, a suspected China-nexus espionage actor.[4]
Google Threat Intelligence Group (Mandiant) 8 January 2025
Attributes the Ivanti Connect Secure zero-day exploitation of CVE-2025-0282 to UNC5221 and says it merged UNC5337 into UNC5221.[5]
CISA 16 October 2026
Says "cyber threat actors" are exploiting CVE-2026-102764 and names no group in the alert text. The alert links to a BeyondTrust blog whose title uses the name ARMORY CASTLE.[2]
Canadian Centre for Cyber Security 16 October 2026
Says open-source reporting indicates exploitation of CVE-2026-102764 and names no group in the alert text. One of its references is the GTIG report.[3]
Only security company research ties the group to China. GTIG calls it suspected PRC-nexus. CISA and the Canadian Cyber Centre name no actor for the BeyondTrust flaw. CISA, the NSA and the Cyber Centre say in a BRICKSTORM report that PRC state-sponsored actors use that backdoor, but the text does not name UNC5221 or ARMORY CASTLE. GTIG also notes that UNC5221 has been used as a synonym for the actor publicly called Silk Typhoon, and says it does not currently consider the two the same.
Each entry is attributed to the group by the sources cited.
GTIG says ARMORY CASTLE has been active as early as October 2023.[1]
Mandiant says UNC5221 exploited CVE-2023-46805 and CVE-2024-21887 as early as December 2023.[5]
After the two Ivanti flaws were disclosed, Mandiant observed widespread exploitation by UNC5221 across many countries and sectors.[5]
Mandiant identified zero-day exploitation of CVE-2025-0282 in Ivanti Connect Secure from mid-December 2024. It reported this on 8 January 2025 and attributed it to UNC5221.[5]
Mandiant dates the earliest exploitation of this Ivanti flaw to mid-March 2025. Ivanti disclosed it on 3 April 2025, and Mandiant attributed it to UNC5221.[4]
GTIG says Mandiant has responded to BRICKSTORM intrusions in the United States since March 2025.[6]
GTIG reports an average of 393 days of undetected access in these intrusions and ties the backdoor to UNC5221 and related clusters.[6]
GTIG says Mandiant found evidence in an incident response case that ARMORY CASTLE exploited CVE-2026-102764 as a zero-day.[1]
The Canadian Cyber Centre says BeyondTrust patched all Remote Support SaaS customers by this date.[3]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 4 December 2025 | CISA, NSA and Canadian Cyber Centre | Malware analysis reportReport AR25-338A on the BRICKSTORM backdoor, which the agencies say PRC state-sponsored actors use for long-term access. Updated 11 February 2026. The text does not name UNC5221.[7] |
| 16 October 2026 | CISA | Alert and KEV listingUrged patching of CVE-2026-102764 and added it to the Known Exploited Vulnerabilities catalog.[2] |
| 16 October 2026 | Canadian Cyber Centre | Alert AL26-025Urged upgrading and applying the BT26-05-RS patch.[3] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Server Software Component: Web Shell T1505.003
Drops the SAWFLY web shell in the appliance web root. In the Ivanti cases GTIG names the LIGHTWIRE web shell.[1, 5, 9]
Boot or Logon Initialization Scripts T1037
Creates a script in the appliance startup directory so the sudo change survives reboots and configuration resets.[1, 13]
Account Manipulation T1098
Raises the permissions of a compromised account from No Access to Administrator for Jump Items and Teams.[1, 15]
Abuse Elevation Control Mechanism: Setuid and Setgid T1548.001
Copies the system shell to a new file, makes root the owner and sets the SUID bit, giving a root backdoor.[1, 10]
Abuse Elevation Control Mechanism: Sudo and Sudo Caching T1548.003
Adds a passwordless sudo entry for the site service account to the appliance sudoers template.[1, 11]
SAWFLY Web shell
PHP web shell (mangoapi.php) with RC4 encrypted, Base32 encoded commands; one of the group's main footholds on the BeyondTrust appliance (2026).[1]
BARECLAW Tunneler
C program that carries a SOCKS5 proxy over WebSocket and was exposed through a changed reverse proxy setting (2026).[1]
BRICKSTORM Backdoor
Go backdoor with SOCKS proxy function, found on Linux and BSD based appliances and tied by GTIG to UNC5221 (2025).[6]
BRICKSTEAL Credential stealer
Malicious servlet filter that captures vCenter logins, tracked by Mandiant in BRICKSTORM intrusions (2025).[6]
TRAILBLAZE Dropper
In-memory dropper used with the Ivanti flaw CVE-2025-22457 (2025).[4]
BRUSHFIRE Backdoor
Passive backdoor injected into a running web process on Ivanti Connect Secure (2025).[4]
SPAWN Malware family
Ecosystem of SPAWNANT installer, SPAWNMOLE tunneler and SPAWNSNAIL SSH backdoor, now attributed to UNC5221 (2025).[4, 5]
ZIPLINE Backdoor
Passive backdoor used after the first Ivanti flaws (2024).[5]
THINSPOOL Dropper
Dropper used after the first Ivanti flaws (2024).[5]
LIGHTWIRE Web shell
Web shell used after the first Ivanti flaws (2024).[5]
WARPWIRE Credential harvester
Credential harvester used after the first Ivanti flaws (2024).[5]
Also linked in our threat library:
Apply BT26-05-RS to self-hosted Remote Support on versions 24.3.1 to 26.2.3. Older versions must be upgraded first. SaaS tenants are already patched.
Allow outside access only to the services users need and keep the /login and /appliance admin pages on trusted networks.
Forward appliance syslog and session events to your SIEM and keep web application firewall and proxy logs, because the group deletes local logs.
After the appliance is patched or rebuilt, revoke active support sessions and rotate every credential it stored or injected, starting with admin and vault credentials. GTIG warns that rotating earlier exposes the new credentials to an attacker who still controls the appliance.
Counters T1555
Look for Jump Item roles raised to Administrator and other unauthorized account, permission or session policy changes.
Look for unrecognized privileged sessions, unrecognized script files and unexpected gaps in logs or log forwarding.
Counters T1505.003
List every edge and remote access appliance and monitor traffic coming from them, since they often have no endpoint agent.
Find remote access and VPN appliances that face the internet and check which versions they run, so the patch queue starts with them.
Follow reports on edge device zero-days and get an alert when a product you run is named.
Watch for company credentials that show up on criminal forums after an appliance compromise.
A suspected China-nexus espionage actor, according to Google Threat Intelligence Group. It is the new name for the cluster GTIG formerly tracked as UNC5221.
Not in the sources we reviewed. CISA and the Canadian Cyber Centre alerts on the BeyondTrust flaw speak of cyber threat actors or open-source reporting and name no group.
CVE-2026-102764 in Remote Support. GTIG says the group used it as a zero-day from late August 2026, before BeyondTrust disclosed it on 15 October 2026.
A web shell called SAWFLY and a tunneler called BARECLAW, both named by GTIG as new custom malware. It also used the appliance's own utilities.
Ivanti Connect Secure, per Mandiant, from December 2023 to 2025. GTIG also ties the BRICKSTORM backdoor to UNC5221.
Patch with BT26-05-RS, treat any appliance that was exposed while unpatched as possibly compromised, rebuild it from a clean image and rotate the credentials it held.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
