Search — “mangoapi.php”

China-nexus espionage actor Armory Castle (formerly UNC5221/Warp Panda) exploited CVE-2026-102764, an improper origin validation flaw in BeyondTrust Remote Support, as a zero-day from late August 2026. The actor staged the SAWFLY PHP webshell (mangoapi.php), escalated to root by planting a SUID copy of /bin/sh at /usr/bin/dbus-authd, and dumped the appliance vault with bt-secrets. It persisted through a post_boot.d script that edits the sudoers template, raised Jump Item roles to Administrator, tunneled traffic with BARECLAW behind a modified haproxy.conf (/uidchanarge), and deleted logs. Hunt for unknown .php POSTs and WebSocket paths at the reverse proxy, user_changed syslog events raising Jump Item roles, file-transfer sessions, and gaps in appliance syslog forwarding.