UNC5221 (Armory Castle) Exploits Unpatched BeyondTrust Flaw — Zero-Day Detection and Containment Guide for Edge Appliance Defenders

---
title: Suspicious Child Process Spawned by BeyondTrust Appliance Services
id: 3f8a2c91-7b4d-4e5a-9c61-2d8f4a1b7e93
status: experimental
description: Detects shell, network, or credential-access tooling spawned as a child of BeyondTrust web server or service processes, consistent with UNC5221 webshell post-exploitation behavior observed in edge appliance intrusions.
references:
  - https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\beyondtrust\'
      - '\bomgar\'
      - '\nginx\'
      - '\apache'
      - '\tomcat'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
      - '\nltest.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate BeyondTrust support technician sessions running diagnostics — validate against approved session recordings before dismissing
level: high
---
title: Webshell Dropped in Web Server Content Directory
id: 9c1e7b52-3a6f-4d48-b2e7-5f0c3d9a8e21
status: experimental
description: Detects creation of script files in web server content or temporary directories, matching UNC5221's known webshell deployment pattern on compromised edge appliances (Ivanti/Citrix campaigns).
references:
  - https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\www\'
      - '\htdocs\'
      - '\webapps\'
      - '\nginx\html\'
      - '\temp\'
      - '\tmp\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.jsp'
      - '.php'
      - '.cgi'
      - '.pl'
  filter_service_accounts:
    User|contains:
      - 'BeyondTrust'
      - 'bomgar'
  condition: selection_path and selection_ext and not filter_service_accounts
falsepositives:
  - Legitimate application updates or hotfix deployments — correlate with change windows and vendor update packages
level: high
---
title: BeyondTrust Appliance Initiating Outbound Connection to Rare External Host
id: 5d2a8f14-6c9b-4e37-a1d4-8b3f6c2e5094
status: experimental
description: Detects BeyondTrust/bomgar processes making outbound network connections to non-BeyondTrust infrastructure, consistent with C2 egress from a compromised appliance.
references:
  - https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|contains:
      - '\beyondtrust\'
      - '\bomgar\'
  selection_port:
    DestinationPort:
      - 443
      - 80
  filter_vendor:
    DestinationHostname|contains:
      - '.beyondtrust.com'
      - '.bomgar.com'
      - '.microsoft.com'
      - '.windowsupdate.com'
  condition: selection_image and selection_port and not filter_vendor
falsepositives:
  - Third-party integrations (ticketing, IdP) — whitelist known integration endpoints by hostname
level: medium

// Hunt: UNC5221 post-exploitation behavior on/near BeyondTrust infrastructure
// Lookback covers the reported ~7 week activity window
let Lookback = 60d;
let BTAssets = (DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any ("beyondtrust.com", "bomgar.com") or InitiatingProcessFileName has_any ("beyondtrust", "bomgar")
    | summarize by DeviceName);
// 1. Suspicious child processes from web service or BeyondTrust processes
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where DeviceName in (BTAssets)
| where InitiatingProcessFileName has_any ("beyondtrust", "bomgar", "nginx", "httpd", "tomcat", "w3wp")
   or FileName has_any ("beyondtrust", "bomgar")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe",
     "nltest.exe", "certutil.exe", "bitsadmin.exe", "rundll32.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
     FileName, ProcessCommandLine, AccountName, SHA256
| sort by TimeGenerated desc;
// 2. Rare outbound destinations from BeyondTrust-associated devices
let CommonDest = todynamic(["beyondtrust.com", "bomgar.com", "microsoft.com", "windowsupdate.com", "digicert.com"]);
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where DeviceName in (BTAssets)
| where RemoteIPType == "Public"
| where not(RemoteUrl has_any (CommonDest))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
| where ConnectionCount < 20   // low-and-slow C2 heuristic
| sort by FirstSeen asc;

// Hunt: Anomalous administrative activity in BeyondTrust appliance Syslog
Syslog
| where TimeGenerated > ago(60d)
| where Computer has_any ("beyondtrust", "bomgar") or Facility == "local4"
| where SyslogMessage has_any ("login", "session", "config", "backup", "download", "export")
| extend SrcIP = extract(@"src=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| summarize EventCount = count(), Actions = make_set(SyslogMessage, 20) by Computer, SrcIP, bin(TimeGenerated, 1h)
| where EventCount > 50 or array_length(Actions) > 10
| sort by TimeGenerated desc;

-- Hunt for webshell-style artifacts and suspicious processes on BeyondTrust-adjacent hosts
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(beyondtrust|bomgar)'
   OR Exe =~ '(nginx|httpd|tomcat|w3wp)'
   OR CommandLine =~ '(certutil|bitsadmin|rundll32).*(http|https)'

-- Sweep web content and temp directories for recently created script files (potential webshells)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/inetpub/wwwroot/**/*.aspx',
  'C:/inetpub/wwwroot/**/*.ashx',
  'C:/**/webapps/**/*.jsp',
  'C:/Windows/Temp/**/*.aspx',
  'C:/Windows/Temp/**/*.jsp',
  'C:/ProgramData/**/*.jsp'
])
WHERE Ctime > '2025-12-15'
ORDER BY Ctime DESC

#!/bin/bash
# BeyondTrust RS/PRA exposure and integrity verification
# Run from a management host with access to the appliance

APPLIANCE="https://your-appliance-hostname"
OUT="bt_audit_$(date +%Y%m%d).log"

echo "=== BeyondTrust Appliance Exposure Audit $(date) ===" | tee "$OUT"

# 1. Confirm appliance version and check against latest vendor advisory
echo "[+] Querying appliance version..." | tee -a "$OUT"
curl -sk "${APPLIANCE}/api/version" | tee -a "$OUT"
echo "[!] Compare against https://www.beyondtrust.com/trust-center/security-advisories" | tee -a "$OUT"

# 2. Verify Syslog forwarding is enabled (external telemetry is critical —
#    UNC5221 is known to tamper with on-box logs)
echo "[+] Checking remote Syslog configuration (expect a configured remote host)..." | tee -a "$OUT"
ssh admin@your-appliance-hostname 'cat /etc/rsyslog.conf 2>/dev/null | grep -v "^#" | grep "@"' | tee -a "$OUT"

# 3. Enumerate unexpected files in web content directories modified in the last 90 days
echo "[+] Scanning web directories for recently modified files..." | tee -a "$OUT"
ssh admin@your-appliance-hostname 'find /var/www /usr/share/nginx /opt -name "*.jsp" -o -name "*.php" -o -name "*.cgi" 2>/dev/null | xargs ls -la 2>/dev/null | awk "{print \$6,\$7,\$8,\$9}"' | tee -a "$OUT"

# 4. Check for unexpected listening ports and outbound connections
echo "[+] Active listeners and established outbound connections..." | tee -a "$OUT"
ssh admin@your-appliance-hostname 'ss -tlnp; echo "---ESTABLISHED---"; ss -tnp state established' | tee -a "$OUT"

# 5. Review recent admin logins for impossible-travel or off-hours activity
echo "[+] Recent authentication events..." | tee -a "$OUT"
ssh admin@your-appliance-hostname 'grep -i "login\|auth" /var/log/messages 2>/dev/null | tail -100' | tee -a "$OUT"

echo "[+] Audit complete. Review $OUT for anomalies." | tee -a "$OUT"

# BeyondTrust-adjacent Windows host hardening and evidence collection
# Run elevated on jump boxes / integration servers that connect to the appliance

$Report = "C:\BT_Containment_Audit_$(Get-Date -Format yyyyMMdd).txt"
"=== BeyondTrust Adjacent Host Audit $(Get-Date) ===" | Out-File $Report

# 1. Identify all processes with BeyondTrust/Bomgar lineage and their network connections
"[+] BeyondTrust-related processes and connections:" | Out-File $Report -Append
Get-Process | Where-Object { $_.Path -match 'beyondtrust|bomgar' } | ForEach-Object {
    $proc = $_
    Get-NetTCPConnection -OwningProcess $proc.Id -ErrorAction SilentlyContinue |
        Where-Object { $_.State -eq 'Established' } |
        Select-Object @{N='Process';E={$proc.ProcessName}}, RemoteAddress, RemotePort |
        Out-File $Report -Append
}

# 2. Verify outbound firewall policy: appliance and jump hosts should only reach
#    BeyondTrust cloud endpoints — deny-by-default everything else
"[+] Current outbound rules for BeyondTrust paths:" | Out-File $Report -Append
Get-NetFirewallRule -Direction Outbound -Action Allow |
    Get-NetFirewallApplicationFilter |
    Where-Object { $_.Program -match 'beyondtrust|bomgar' } |
    Out-File $Report -Append
"[!] ACTION: Create explicit ALLOW rules for *.beyondtrust.com only, then DENY all other egress from appliance/jump hosts." | Out-File $Report -Append

# 3. Rotate credentials potentially exposed through the PAM platform
"[!] MANUAL ACTION REQUIRED: Rotate all credentials vaulted in or brokered by BeyondTrust:" | Out-File $Report -Append
"    - Service accounts used by Remote Support/PRA" | Out-File $Report -Append
"    - API keys and OAuth client secrets registered in the appliance" | Out-File $Report -Append
"    - Any domain admin credentials ever injected through a BeyondTrust session" | Out-File $Report -Append

# 4. Enable Sysmon process-creation and network-connection auditing if not present
if (-not (Get-Service Sysmon64 -ErrorAction SilentlyContinue)) {
    "[!] Sysmon not detected — deploy with a process/network logging config for appliance-adjacent hosts." | Out-File $Report -Append
}

Write-Host "Audit written to $Report — review flagged actions immediately."