SAWFLYSAWFLY

Obfuscated PHP web shell reported by Google Threat Intelligence Group and Mandiant in ARMORY CASTLE (formerly UNC5221) intrusions exploiting CVE-2026-102764 in BeyondTrust Remote Support, used as a zero-day from late August 2026. Deployed as mangoapi.php, it uses Base32 transport and RC4 encryption and served as a primary foothold on compromised appliances, alongside the BARECLAW tunneler.