BARECLAWBARECLAW

SOCKS5-over-WebSocket tunneler written in C, reported by Google Threat Intelligence Group and Mandiant in ARMORY CASTLE (formerly UNC5221) intrusions exploiting CVE-2026-102764 in BeyondTrust Remote Support. Deployed as ingredi_ws, it was exposed to the operator by editing the appliance's HAProxy configuration, giving tunnelled access to internal networks from the compromised appliance; it was used alongside the SAWFLY web shell.