ARMORY CASTLE

Reported Context (16)

Google Threat Intelligence Group and Mandiant attributed the observed exploitation to this group; BeyondTrust assessed the attribution with moderate-to-high confidence. BeyondTrust Remote Support Zero-Day Exploited in Espionage Campaign
China-linked, state-sponsored espionage group reported to have exploited CVE-2026-102764 as a zero-day. China-Linked APT Exploited BeyondTrust Remote Support Flaw as a Zero-Day
China-nexus cyber espionage group reported to have exploited the BeyondTrust Remote Support zero-day. China-Linked Group Exploited BeyondTrust Remote Support Zero-Day
Suspected China-nexus espionage actor tracked by Mandiant and GTIG; formerly tracked as UNC5221. BeyondTrust patches zero-day exploited since late August
Mandiant attributed exploitation of the BeyondTrust zero-day to this likely Chinese government-backed espionage group. Suspected Chinese Espionage Group Exploited BeyondTrust Zero-Day

CVE (17)

Malware (21)

People (23)

Threat Actors (44)

MITRE ATT&CK (54)

Vendors (26)

Products (37)

Tools (23)

Industries (32)

Countries (30)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.