BARECLAW is a tunneler written in C that Google Threat Intelligence Group says a suspected China-nexus espionage group ran on a BeyondTrust Remote Support appliance in 2026. It turns the appliance into a hidden SOCKS5 proxy into the victim network.
What it does
GTIG describes BARECLAW as a SOCKS5 proxy carried over WebSocket. It embeds the CivetWeb web server and OpenSSL. Operators can require a token, obfuscate traffic, limit reachable networks by CIDR range, chain to another proxy and change the listening ports. Authentication, filtering and TLS are off by default.
In the case GTIG describes, it listened on a local port and the attackers edited the appliance reverse proxy so one URL path led to it. That kept it hidden from outside port scans. The case is tied to CVE-2026-102764 and to ARMORY CASTLE. The same attackers dropped the SAWFLY web shell as a foothold on the appliance.
GTIG also ties this group to the BRICKSTORM backdoor, which it hides on VMware vCenter servers and network appliances.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| BARECLAW | Name given by Google Threat Intelligence Group in October 2026[1] |
What it can do
The ATT&CK techniques the cited sources map to this tool, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Command and Control
How it spreads
GTIG does not describe BARECLAW spreading. In the 2026 case the attackers started it by hand on the appliance, from a temporary folder.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Appliance controlled
The attackers control the appliance after exploiting CVE-2026-102764.[1]
Tunneler started
They run the program from a temporary folder with a listening port, a token, obfuscation and quiet mode.[1]
Proxy edited
They change the reverse proxy file so one URL path is routed to the tunneler on a local port.[1]
Internet access
Clients can now reach the tunneler through the appliance's public address, while the port stays closed to outside scans.[1]
Timeline
Detection and defense
Frequently Asked Questions
What is BARECLAW?
A tunneler written in C that Google Threat Intelligence Group found on a compromised BeyondTrust Remote Support appliance. It acts as a SOCKS5 proxy over WebSocket.
Who used it?
GTIG attributes it to ARMORY CASTLE, a suspected China-nexus espionage actor. No government body has named the group.
Why was it hard to see from outside?
GTIG says it listened only on the local address, and a reverse proxy rule sent one URL path to it, so port scans would not show it.
What does GTIG advise?
Patch, isolate suspect appliances, restrict outbound traffic, and rebuild exposed appliances from a clean image.
Sources
- ARMORY CASTLE Exploits BeyondTrustGoogle Threat Intelligence Group (Mandiant) · Supports: Description of BARECLAW, options, command line, HAProxy change, attribution
- CISA Urges Patching Critical Vulnerability in BeyondTrust Remote SupportCISA · Supports: Active exploitation of CVE-2026-102764, patch and hunt guidance
- AL26-025 Critical vulnerability impacting BeyondTrust Remote Support (CVE-2026-102764)Canadian Centre for Cyber Security · Supports: Affected versions and fixed version
- Protocol Tunneling, Technique T1572MITRE ATT&CK · Supports: Technique id and name
- Proxy, Technique T1090MITRE ATT&CK · Supports: Technique id and name
- Obfuscated Files or Information, Technique T1027MITRE ATT&CK · Supports: Technique id and name
