Chinese hackers exploit BeyondTrust zero-day in espionage push

CVE-2026-102764 — a critical defect in BeyondTrust Remote Support — was first exploited on Aug. 29, according to BeyondTrust, and security researchers attribute the campaign to Armory Castle (previously tracked as UNC5221).

CVE-2026-102764 and the immediate impact on BeyondTrust customers

Mandiant and Google Threat Intelligence Group (GTIG) researchers say the zero-day in BeyondTrust’s Remote Support product was exploited beginning in late August. BeyondTrust disclosed the vulnerability publicly on Thursday and said it released a patch for self-hosted customers on Oct. 8 and automatically applied the update to cloud-based instances that same day. BeyondTrust also said the first known instance of zero-day exploitation occurred Aug. 29, which the company detected and contained on Sept. 28.

Armory Castle (formerly UNC5221): techniques, targets and history

Mandiant identified the actor behind the exploitation as a likely Chinese government-backed espionage group it previously tracked as UNC5221 and now calls Armory Castle. Researchers said Armory Castle exploited CVE-2026-102764 and used multiple tactics to escalate privileges, move laterally and evade detection inside victim networks.

GTIG’s Dan Perez described Armory Castle as “one of the most prominent China-nexus threat actors due to its persistent targeting of various edge device technologies, use of zero-day vulnerabilities for widespread exploitation across multiple industries and regions, and its continuously expanding and evolving arsenal of tools.” The group’s earlier activity includes repeated exploitation of Ivanti defects since 2023, a Citrix NetScaler zero-day commonly referred to as CitrixBleed, and last year’s Brickstorm campaign that had an average dwell time of 400 days.

Timeline and connection to other zero-day activity

BeyondTrust said it detected malicious activity after zero-days were confirmed to be exploited in another security vendor’s product on Sept. 27. That sequence aligns with a separate round of Citrix NetScaler zero-days that were disclosed amid nearly two days of “rampant worry and unconfirmed rumors,” according to the reporting. BeyondTrust did not say whether there is any direct link between the Citrix NetScaler incidents — which went undetected for more than three weeks — and the attacks against its remote-access product.

Mandiant and GTIG reported the BeyondTrust-focused activity as ongoing analysis was being completed. GTIG’s Kelli Vanderlee cautioned: “We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure.” Mandiant warned organizations to “prepare for potential widespread exploitation,” noting that Armory Castle and other groups have previously conducted broad, opportunistic exploitation after public vulnerability disclosures.

BeyondTrust’s response and operational characteristics of the actor

BeyondTrust said it coordinated with Mandiant on an investigation involving a compromised self-hosted customer and emphasized the adversary’s operational security. “This threat actor rotates its infrastructure and tooling for every victim, so attribution here rests on behavior. The indicators from one intrusion rarely survive to the next,” the company’s security team wrote in a blog post.

A BeyondTrust spokesperson declined to answer questions about how many customers were compromised or why the firm did not publicly disclose the actively exploited zero-day sooner, referring reporters to the company’s security advisory. The company reported detecting and containing the Aug. 29 exploitation on Sept. 28 and noted its patching actions on Oct. 8.

What this means for technologists, affected enterprises, and BeyondTrust customers

• Technologists and security teams: GTIG researchers urged potentially vulnerable organizations to apply the patch and hunt for pre-disclosure activity. Vanderlee warned that Armory Castle’s focus on edge devices — “which typically do not support endpoint detection and response (EDR)” — helps the actor minimize detection opportunities and maintain stealthy, persistent access.
• Affected enterprises (business-process outsourcers, government, legal services, technology companies and SaaS providers): These sectors appear on Armory Castle’s previous target list; organizations in those categories should confirm patch status for Remote Support and review intrusion detection and network logs for signs of lateral movement or privilege escalation tied to this campaign.
• BeyondTrust customers and procurement leaders: BeyondTrust’s decision to auto-apply cloud updates on Oct. 8 and to patch self-hosted instances the same day addresses the immediate vulnerability, but the company’s refusal to disclose the extent of compromise or the timing rationale raises questions that customers and procurement teams will likely want answered regarding incident communication and risk exposure.

Armory Castle’s pattern — rapid exploitation of zero-days in edge and remote-access technologies, rotation of tooling and infrastructure, and targeting across industries and regions — means defenders must assume that stealthy, pre-disclosure intrusions remain plausible. Mandiant’s blunt advice to “prepare for potential widespread exploitation,” paired with BeyondTrust’s patching and containment timeline, leaves a clear next step for defenders: apply the Oct. 8 fix, hunt for signs of compromise, and scrutinize remote-access logs for activity dating back to late August.

Source: CyberScoop — Prolific Chinese espionage group exploits BeyondTrust zero-day