Log in Request a demo

Malware profile

BARECLAW tunneler

BARECLAW is a tunneler written in C that Google Threat Intelligence Group says a suspected China-nexus espionage group ran on a BeyondTrust Remote Support appliance in 2026.

In short

BARECLAW is a tunneler written in C that Google Threat Intelligence Group says a suspected China-nexus espionage group ran on a BeyondTrust Remote Support appliance in 2026. It turns the appliance into a hidden SOCKS5 proxy into the victim network.

Last updated 19 October 2026

Profile MapMalware
  1. Names1names in public reportsBARECLAW
  2. Techniques3ATT&CK techniques listedCommand and Control · Defense Evasion
  3. Infection Steps4in the delivery chainAppliance controlled · Tunneler started

In one minute

What it is
A C tunneler that GTIG tracks as BARECLAW. It relays TCP connections over a WebSocket SOCKS5 proxy.
What it does
It lets an attacker reach internal systems through the compromised appliance, with optional token login and XOR-based obfuscation of the data.
Who uses it
Attributed by Google Threat Intelligence Group (15 October 2026) to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221.
How it gets in
Run on a BeyondTrust Remote Support appliance after exploitation of CVE-2026-102764, then exposed by an edit to the HAProxy configuration.
What to do first
Patch with BT26-05-RS, rebuild any appliance exposed while unpatched, and review the reverse proxy configuration against a clean baseline.

What it does

GTIG describes BARECLAW as a SOCKS5 proxy carried over WebSocket. It embeds the CivetWeb web server and OpenSSL. Operators can require a token, obfuscate traffic, limit reachable networks by CIDR range, chain to another proxy and change the listening ports. Authentication, filtering and TLS are off by default.

In the case GTIG describes, it listened on a local port and the attackers edited the appliance reverse proxy so one URL path led to it. That kept it hidden from outside port scans. The case is tied to CVE-2026-102764 and to ARMORY CASTLE. The same attackers dropped the SAWFLY web shell as a foothold on the appliance.

GTIG also ties this group to the BRICKSTORM backdoor, which it hides on VMware vCenter servers and network appliances.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
BARECLAWName given by Google Threat Intelligence Group in October 2026[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Command and Control

  • Protocol Tunneling T1572

    Carries proxy traffic inside WebSocket connections.[1, 4]

  • Proxy T1090

    Works as a SOCKS5 proxy that relays TCP connections and can chain to an upstream proxy.[1, 5]

Defense Evasion

  • Obfuscated Files or Information T1027

    Can obfuscate tunneled data with an XOR stream routine and suppress all logging.[1, 6]

How it spreads

GTIG does not describe BARECLAW spreading. In the 2026 case the attackers started it by hand on the appliance, from a temporary folder.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Appliance controlled

    The attackers control the appliance after exploiting CVE-2026-102764.[1]

  2. Tunneler started

    They run the program from a temporary folder with a listening port, a token, obfuscation and quiet mode.[1]

  3. Proxy edited

    They change the reverse proxy file so one URL path is routed to the tunneler on a local port.[1]

  4. Internet access

    Clients can now reach the tunneler through the appliance's public address, while the port stays closed to outside scans.[1]

Timeline

  1. Late August 2026

    Zero-day use

    GTIG says Mandiant found evidence that ARMORY CASTLE exploited CVE-2026-102764 as a zero-day. BARECLAW was deployed in that case.[1]

  2. 15 October 2026

    Report published

    GTIG publishes its analysis of BARECLAW and SAWFLY. BeyondTrust discloses the flaw.[1]

  3. 16 October 2026

    Government alerts

    CISA adds CVE-2026-102764 to its Known Exploited Vulnerabilities catalog. CISA and the Canadian Cyber Centre name no malware.[2, 3]

Detection and defense

  1. Patch and rebuild

    Apply BT26-05-RS and redeploy any appliance that was exposed while unpatched from a clean image.[1, 2]

    Counters: T1572 T1090

  2. Review the proxy setup

    Check the appliance reverse proxy file for rules you did not add, such as a URL path routed to an unknown local port.[1]

    Counters: T1090

  3. Limit outbound traffic

    Deny outbound traffic from the appliance except to the vendor's update and licensing endpoints, and log every denied connection.[1]

    Counters: T1572

  4. Watch the edge

    Put a reverse proxy or web application firewall with full URL logging in front of the appliance, so you keep a record the appliance cannot change.[1]

    Counters: T1572 T1090

Questions

What is BARECLAW?

A tunneler written in C that Google Threat Intelligence Group found on a compromised BeyondTrust Remote Support appliance. It acts as a SOCKS5 proxy over WebSocket.

Who used it?

GTIG attributes it to ARMORY CASTLE, a suspected China-nexus espionage actor. No government body has named the group.

Why was it hard to see from outside?

GTIG says it listened only on the local address, and a reverse proxy rule sent one URL path to it, so port scans would not show it.

What does GTIG advise?

Patch, isolate suspect appliances, restrict outbound traffic, and rebuild exposed appliances from a clean image.

In our research

  1. ARMORY CASTLE Threat group

Sources

  1. ARMORY CASTLE Exploits BeyondTrust Google Threat Intelligence Group (Mandiant)Supports: Description of BARECLAW, options, command line, HAProxy change, attribution
  2. CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support CISASupports: Active exploitation of CVE-2026-102764, patch and hunt guidance
  3. AL26-025 Critical vulnerability impacting BeyondTrust Remote Support (CVE-2026-102764) Canadian Centre for Cyber SecuritySupports: Affected versions and fixed version
  4. Protocol Tunneling, Technique T1572 MITRE ATT&CKSupports: Technique id and name
  5. Proxy, Technique T1090 MITRE ATT&CKSupports: Technique id and name
  6. Obfuscated Files or Information, Technique T1027 MITRE ATT&CKSupports: Technique id and name

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

ARMORY CASTLE

Google Threat Intelligence Group attributes the zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764), which it dates to late August 2026, to ARMORY CASTLE, a suspected China-linked spying group it formerly tracked as UNC5221. No government has named the group.

Read more

Incident

US Treasury breach through BeyondTrust

In late 2024 a hacker gained access to the Departmental Offices network of the US Department of the Treasury, and the case became public in early January 2025.

Read more

Malware

SAWFLY web shell

SAWFLY is a small PHP web shell that Google Threat Intelligence Group says a suspected China-nexus espionage group used on BeyondTrust Remote Support appliances in 2026.

Read more