Post
trinity.sh
did:plc:7bpo4lsivmqxfsr2kifmz6zz
CVE-2026-102764: ARMORY CASTLE exploited a BeyondTrust Remote Support zero-day, dropping SAWFLY webshell and BARECLAW SOCKS5 tunneler. Custom malware, HAProxy backdoor, log wiping. CVSS 9.3. Exploited since August.
https://trinity.sh/posts/2026-10-17-cve-2026-102764-beyondtrust-zero-day/
2026-10-17T05:00:07.654Z