cyber.hendryadrian.com
Security News · cyberscoop.com

Suspected Chinese Espionage Group Exploited BeyondTrust Zero-Day

· Original article ↗

Summary

Mandiant and Google Threat Intelligence Group say suspected Chinese group Armory Castle exploited a BeyondTrust Remote Support zero-day from Aug. 29. BeyondTrust says it contained a known intrusion and released a patch Oct. 8.

Key points

  • Researchers attribute the campaign to Armory Castle, previously tracked as UNC5221, which they assess is likely backed by the Chinese government.
  • The group exploited CVE-2026-102764 in BeyondTrust Remote Support; researchers say it used tactics to escalate privileges, move through compromised networks and evade detection.
  • BeyondTrust said the first known exploitation occurred Aug. 29 and that it detected and contained the activity on Sept. 28.
  • BeyondTrust said it released a patch for self-hosted customers and automatically updated cloud-based versions on Oct. 8.
  • Mandiant investigated a compromised self-hosted customer with BeyondTrust. Researchers said only a small number of organizations were known to be affected, but more may have been compromised before disclosure.
  • Researchers urged potentially vulnerable organizations to apply the patch and hunt for activity before the vulnerability was disclosed.

Article Details

Event Type
Zero-day exploitation of a critical vulnerability in BeyondTrust Remote Support, attributed by Mandiant to the espionage group Armory Castle.
Impact
BeyondTrust reported that a self-hosted customer was compromised. The first known exploitation occurred on August 29 and was detected and contained on September 28. Researchers said only a small number of organizations were known to be impacted, while warning that additional organizations may have been compromised before disclosure. BeyondTrust said it released a patch for self-hosted customers and automatically applied the update to cloud-based versions on October 8.

CVE

CVE-2026-102764group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multiple tactics to escalate privileges, hop around the compromised network and

People

Dan PerezTechnical lead at Google Threat Intelligence Group; described Armory Castle's targeting and use of zero-day vulnerabilities.Kelli VanderleeSenior analyst at Google Threat Intelligence Group; commented on the potential for additional organizations to have been compromised and on Armory Castle's targeting of edge devices.

Threat Actors

ARMORY CASTLEMandiant attributed exploitation of the BeyondTrust zero-day to this likely Chinese government-backed espionage group.

Vendors

BeyondTrustSuspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August.

Products

BeyondTrust Remote SupportMandiant and GTIG released their analysis of Armory Castle and its latest campaign as BeyondTrust publicly disclosed the vulnerability in its Remote Support product Thursday.Citrix NetScalerThe same threat group has repeatedly exploited a series of defects in Ivanti products since 2023, a Citrix NetScaler zero-day widely known as CitrixBleed, and last year’s Brickstorm campaign that had an average dwell

Countries

China“Armory Castle remains one of the most prominent China-nexus threat actors due to its persistent targeting of various edge device technologies, use of zero-day vulnerabilities for widespread exploitation across multiple

Industries

GovernmentMandiant researchers said a likely Chinese government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multipleLegal servicesThe threat group’s previous targets include business-process outsourcers, government, legal services, technology companies and software-as-a-service providers.Software-as-a-serviceThe threat group’s previous targets include business-process outsourcers, government, legal services, technology companies and software-as-a-service providers.TechnologyThe threat group’s previous targets include business-process outsourcers, government, legal services, technology companies and software-as-a-service providers.

Related Articles