China-Linked Hackers Exploited BeyondTrust Zero-Day to Deploy SAWFLY and BARECLAW Malware
Armory Castle exploited a BeyondTrust Remote Support zero-day on a self-hosted appliance and deployed the SAWFLY web shell.
More info