It hides its commands in encrypted traffic and stays silent when a request lacks the right parameter.
What it does
GTIG calls SAWFLY (file name mangoapi.php) an obfuscated, lightweight PHP web shell. It carries commands in a custom Base32 format and encrypts them with a 256-bit RC4 key. It runs the decoded PHP code and returns any result in the same encrypted form.
GTIG says the attackers used it as one of their main footholds and ran commands from it with elevated rights, for example to delete logs. It was found in the attack described on our page about CVE-2026-102764, attributed by GTIG to ARMORY CASTLE. The same attackers also used the BARECLAW tunneler to carry traffic through the appliance.
GTIG also ties this group to the BRICKSTORM backdoor, which it hides on VMware vCenter servers and network appliances.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| SAWFLY | Name given by Google Threat Intelligence Group in October 2026[1] |
What it can do
The ATT&CK techniques the cited sources map to this tool, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Persistence
Command and Control
How it spreads
GTIG says the web shell appeared on the appliance about 11 minutes after the first POST requests that followed exploitation of CVE-2026-102764. It does not spread on its own.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Flaw exploited
The attacker abuses CVE-2026-102764 and sends POST requests to a PHP file on the appliance.[1]
Web shell written
About 11 minutes later the file system records SAWFLY in the web root.[1]
Commands sent
The attacker posts an encoded, RC4 encrypted payload in the hidden parameter and the shell runs it.[1]
Next steps
The attacker copies a shell binary with the SUID bit, tries to dump the appliance's stored secrets and, from the web shell, deletes logs with sudo rights.[1]
Timeline
- Late August 2026
Zero-day use
GTIG says Mandiant found evidence that ARMORY CASTLE exploited CVE-2026-102764 as a zero-day. SAWFLY was one of the tools used after that.[1]
- 15 October 2026
Report published
GTIG publishes its analysis of SAWFLY and names the BARECLAW tunneler used beside it. BeyondTrust discloses the flaw.[1]
- 16 October 2026
Detection and defense
Frequently Asked Questions
What is SAWFLY?
A PHP web shell that Google Threat Intelligence Group tracks. It was used on BeyondTrust Remote Support appliances after the zero-day CVE-2026-102764.
Who used it?
GTIG attributes it to ARMORY CASTLE, a suspected China-nexus espionage actor. No government body has named the group.
How does SAWFLY hide?
It answers only requests with a hidden POST parameter, returns 404 otherwise, and encrypts its traffic with RC4.
How do I find it?
CISA advises looking for unrecognized script files and gaps in logs on affected appliances, and rebuilding from a known-good state.
Sources
- ARMORY CASTLE Exploits BeyondTrustGoogle Threat Intelligence Group (Mandiant) · Supports: Description of SAWFLY, parameter, encryption, foothold, deleted logs, attribution
- CISA Urges Patching Critical Vulnerability in BeyondTrust Remote SupportCISA · Supports: Active exploitation of CVE-2026-102764, patch and hunt guidance
- AL26-025 Critical vulnerability impacting BeyondTrust Remote Support (CVE-2026-102764)Canadian Centre for Cyber Security · Supports: Affected versions and fixed version
- Server Software Component: Web Shell, Sub-technique T1505.003MITRE ATT&CK · Supports: Technique id and name
- Encrypted Channel: Symmetric Cryptography, Sub-technique T1573.001MITRE ATT&CK · Supports: Technique id and name
- Data Encoding: Non-Standard Encoding, Sub-technique T1132.002MITRE ATT&CK · Supports: Technique id and name
- Obfuscated Files or Information, Technique T1027MITRE ATT&CK · Supports: Technique id and name
