---
title: Hunt: ARMORY CASTLE on BeyondTrust Remote Support (SAWFLY web shell, SUID dbus-authd, bt-secrets vault dumps) | ctxsec
url: https://ctxsec.com/items/hunt-armory-castle-beyondtrust
description: ""
status: "vendor IOCs/TTPs"
published: 2026-10-15
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-armory-castle-beyondtrust.md)

vendor IOCs/TTPs

2026-10-15

### Hunt: ARMORY CASTLE on BeyondTrust Remote Support (SAWFLY web shell, SUID dbus-authd, bt-secrets vault dumps)

From Mandiant's writeup: initial POSTs to `/app_84304470%2Ephp`, then the SAWFLY PHP web shell (`mangoapi.php`) under `.../ingredi/app/laravel/public/`. SAWFLY returns 404 unless a POST carries the parameter `_c94mfe`, then Base32-decodes and RC4-decrypts it and runs it with `eval()`. For root, the actor copied `/bin/sh` to `/usr/bin/dbus-authd`, chowned it to root and set SUID. It dumped credentials with `/ns/sbin/bt-secrets get ... vault` and then deleted `/home/bomgar/log/bt-secrets.log*`; it also used a BARECLAW tunneler and wiped logs. BeyondTrust adds behavioral hunts: admin sessions from residential broadband or commercial VPN exits you can't tie to a ticket, new script files in web directories, web service accounts spawning shells, changed Jump Item or Team permissions, and log-forwarding gaps that open and close within one session. Because on-box logs may be gone or tampered with, rely on off-box SIEM copies. Mandiant's post includes hashes and YARA rules.

Sources: [Mandiant: ARMORY CASTLE Exploits BeyondTrust](https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust) · [BeyondTrust blog: ARMORY CASTLE and BT26-05](https://www.beyondtrust.com/blog/entry/bt26-05)