Search — “/usr/bin/dbus-authd”

BeyondTrust patched CVE-2026-102764, a critical auth-bypass/file-operation zero-day in Remote Support (and shared PRA code) exploited since late August 2026 by suspected PRC-nexus actor ARMORY CASTLE (UNC5221/Warp Panda). Attackers uploaded the SAWFLY PHP webshell, escalated to root via a SUID-bit copy of /bin/sh, dumped the appliance credential vault with bt-secrets, added passwordless sudo persistence surviving reboot, deployed the BARECLAW SOCKS5 WebSocket tunneler via haproxy.conf changes, wiped logs, and abused Administrator sessions for lateral movement. Hunt for unknown .php POSTs, SUID binaries like /usr/bin/dbus-authd, sudoers.template changes, haproxy ACL routing, and Jump Item role escalations.

China-nexus espionage actor Armory Castle (formerly UNC5221/Warp Panda) exploited CVE-2026-102764, an improper origin validation flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. The actor staged the SAWFLY PHP webshell (mangoapi.php), escalated to root by planting a SUID copy of /bin/sh at /usr/bin/dbus-authd, and dumped the appliance vault with bt-secrets. It persisted through a post_boot.d script that edits the sudoers template, raised Jump Item roles to Administrator, tunneled traffic with BARECLAW behind a modified haproxy.conf (/uidchanarge), and deleted logs. Hunt for unknown .php POSTs and WebSocket paths at the reverse proxy, user_changed syslog events raising Jump Item roles, file-transfer sessions, and gaps in appliance syslog forwarding.