SAWFLY is a small PHP web shell that Google Threat Intelligence Group says a suspected China-nexus espionage group used on BeyondTrust Remote Support appliances in 2026.
In short
SAWFLY is a small PHP web shell that Google Threat Intelligence Group says a suspected China-nexus espionage group used on BeyondTrust Remote Support appliances in 2026. It hides its commands in encrypted traffic and stays silent when a request lacks the right parameter.
Last updated 19 October 2026
Profile MapMalware
Names2names in public reportsSAWFLY · mangoapi.php
Techniques4ATT&CK techniques listedPersistence · Command and Control · Defense Evasion
Infection Steps4in the delivery chainFlaw exploited · Web shell written
In one minute
What it is
A PHP web shell, mangoapi.php, that GTIG tracks as SAWFLY and describes as obfuscated and lightweight.
What it does
It reads a hidden POST parameter, decodes and decrypts the payload with RC4, runs the PHP code and sends back an encrypted result. Without the parameter it returns a 404 page.
Who uses it
Attributed by Google Threat Intelligence Group (15 October 2026) to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221.
How it gets in
Placed in the web root of a BeyondTrust Remote Support appliance after exploitation of the zero-day flaw CVE-2026-102764.
What to do first
Patch with BT26-05-RS, rebuild any appliance that was exposed while unpatched, and rotate the credentials it held.
What it does
GTIG calls SAWFLY (file name mangoapi.php) an obfuscated, lightweight PHP web shell. It carries commands in a custom Base32 format and encrypts them with a 256-bit RC4 key. It runs the decoded PHP code and returns any result in the same encrypted form.
GTIG says the attackers used it as one of their main footholds and ran commands from it with elevated rights, for example to delete logs. It was found in the attack described on our page about CVE-2026-102764, attributed by GTIG to ARMORY CASTLE. The same attackers also used the BARECLAW tunneler to carry traffic through the appliance.
GTIG also ties this group to the BRICKSTORM backdoor, which it hides on VMware vCenter servers and network appliances.
Names
Public sources use several names for this malware.
Names
Name
Where it appears
SAWFLY
Name given by Google Threat Intelligence Group in October 2026[1]
The script itself is obfuscated, and it returns a 404 reply to any request that lacks its hidden parameter.[1, 7]
How it spreads
GTIG says the web shell appeared on the appliance about 11 minutes after the first POST requests that followed exploitation of CVE-2026-102764. It does not spread on its own.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
1
Flaw exploited
The attacker abuses CVE-2026-102764 and sends POST requests to a PHP file on the appliance.[1]
2
Web shell written
About 11 minutes later the file system records SAWFLY in the web root.[1]
3
Commands sent
The attacker posts an encoded, RC4 encrypted payload in the hidden parameter and the shell runs it.[1]
4
Next steps
The attacker copies a shell binary with the SUID bit, tries to dump the appliance's stored secrets and, from the web shell, deletes logs with sudo rights.[1]
Timeline
Late August 2026
Zero-day use
GTIG says Mandiant found evidence that ARMORY CASTLE exploited CVE-2026-102764 as a zero-day. SAWFLY was one of the tools used after that.[1]
15 October 2026
Report published
GTIG publishes its analysis of SAWFLY and names the BARECLAW tunneler used beside it. BeyondTrust discloses the flaw.[1]
16 October 2026
Government alerts
CISA adds CVE-2026-102764 to its Known Exploited Vulnerabilities catalog. CISA and the Canadian Cyber Centre name no malware.[2, 3]
Detection and defense
Patch and rebuild
Apply BT26-05-RS. Redeploy any appliance that was exposed while unpatched from a clean, patched image, because host-level changes survive reboots.[1, 2]
Google Threat Intelligence Group attributes the zero-day exploitation of BeyondTrust Remote Support (CVE-2026-102764), which it dates to late August 2026, to ARMORY CASTLE, a suspected China-linked spying group it formerly tracked as UNC5221. No government has named the group.
In late 2024 a hacker gained access to the Departmental Offices network of the US Department of the Treasury, and the case became public in early January 2025.
