ARMORY CASTLE used a BeyondTrust 0-day to drop a webshell, root the appliance and dump Vault secrets. https://intel.threadlinqs.com/threat/TL-2026-3668 #ThreatIntel #CVE_2026_102764 #SAWFLY #BARECLAW
@threadlinqs.bsky.social
@threadlinqs.bsky.social
@threadlinqs.bsky.socialARMORY CASTLE used a BeyondTrust 0-day to drop a webshell, root the appliance and dump Vault secrets. https://intel.threadlinqs.com/threat/TL-2026-3668 #ThreatIntel #CVE_2026_102764 #SAWFLY #BARECLAW