China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Go
The threat actor, tracked as Armory Castle, was observed to escalate privileges and established persistent access to compromised BeyondTrust Remote Support appliances following exploitation of the flaw, CVE-2026-102764, in August 2026.
Although the company shared very limited details about the vulnerability, it said the zero-day was abused in the wild by a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group (GTIG) security researchers as "Armory Castle" (formerly UNC5221 ) and by cybersecurity firm CrowdStrike as "Warp Panda." According to Mandiant researchers, who spotted the initial attacks, Armory Castle hackers exploited the flaw to gain initial access and escalated to root privileges on compromised devices by enabling Set User ID (SUID) permissions.
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
Armory Castle is known for targeting zero-day vulnerabilities in network edge appliances, including various Citrix NetScaler ( CVE-2023-4966 ) and Ivanti Connect Secure ( CVE-2023-46805 and CVE-2024-21887 , then CVE-2025-0282 ) appliances, since at least October 2023 to breach enterprise networks and drop new custom malware.
A patch was released on October 8 for software-as-a-service (SaaS) and self-hosted customers.
The vendor said it is withholding technical details of the vulnerability, as disclosing such information while appliances are still being patched could put customers at an increased risk.
The threat actor, tracked as Armory Castle, was observed to escalate privileges and established persistent access to compromised BeyondTrust Remote Support appliances following exploitation of the flaw, CVE-2026-102764, in August 2026.
In its blog published on October 15, Google urged affected BeyondTrust customers to apply patches immediately.
Google has assessed with high confidence that Armory Castle will continue to leverage zero-day vulnerabilities in edge devices to gain access to environments to support their espionage objective.
In addition to applying BeyondTrust’s patch for CVE-2026-102764, Google provided a number of recommendations for organizations who believe may be targeted by Armory Castle.
What happened
Although the company shared very limited details about the vulnerability, it said the zero-day was abused in the wild by a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group (GTIG) security researchers as "Armory Castle" (formerly UNC5221 ) and by cybersecurity firm CrowdStrike as "Warp Panda." According to Mandiant researchers, who spotted the initial attacks, Armory Castle hackers exploited the flaw to gain initial access and escalated to root privileges on compromised devices by enabling Set User ID (SUID) permissions.
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.
What changed
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
Armory Castle is known for targeting zero-day vulnerabilities in network edge appliances, including various Citrix NetScaler ( CVE-2023-4966 ) and Ivanti Connect Secure ( CVE-2023-46805 and CVE-2024-21887 , then CVE-2025-0282 ) appliances, since at least October 2023 to breach enterprise networks and drop new custom malware.
Who is affected
A patch was released on October 8 for software-as-a-service (SaaS) and self-hosted customers.
The vendor said it is withholding technical details of the vulnerability, as disclosing such information while appliances are still being patched could put customers at an increased risk.
Why it matters
The threat actor, tracked as Armory Castle, was observed to escalate privileges and established persistent access to compromised BeyondTrust Remote Support appliances following exploitation of the flaw, CVE-2026-102764, in August 2026.
In its blog published on October 15, Google urged affected BeyondTrust customers to apply patches immediately.
Technical details
Google has assessed with high confidence that Armory Castle will continue to leverage zero-day vulnerabilities in edge devices to gain access to environments to support their espionage objective.
In addition to applying BeyondTrust’s patch for CVE-2026-102764, Google provided a number of recommendations for organizations who believe may be targeted by Armory Castle.
Remote Support is the company's enterprise-grade support solution that helps IT service desks, help desks, and customer support teams troubleshoot issues remotely.
Response
Tracked as CVE-2026-102764 , this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier.
Most recently, attackers exploited another critical remote code execution vulnerability (CVE-2026-1731) affecting Remote Support and Privileged Remote Access appliances to establish WebSocket channels and deploy ransomware .
What security teams should do
This configuration change granted the threat actor permanent, unrestricted authorization to launch remote sessions to downstream systems populated within the appliance's Jump Item list.
Attribution
Infosecurity Magazine: The threat actor, tracked as Armory Castle, was observed to escalate privileges and established persistent access to compromised BeyondTrust Remote Support appliances following exploitation of the flaw, CVE-2026-102764, in August 2026.
BleepingComputer: BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.