Google Mandiant details how ARMORY CASTLE exploited a BeyondTrust Remote Support zero-day, deployed SAWFLY, and used BARECLAW to tunnel into downstream systems. https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/
Google Cloud BlogARMORY CASTLE Exploits BeyondTrust | Google Cloud BlogARMORY CASTLE exploited zero day vulnerabilities in BeyondTrust Remote Support appliances to establish persistent, stealthy access to compromised devices