China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group Armory Castle, also known as UNC5221 or Warp Panda, exploited CVE-2026-102764 in late August 2026. The vulnerability has a CVSS score of 9.3 and involves improper origin validation in an internal messaging component that could be exploited. Organizations should monitor BeyondTrust Remote Support for updates.
Sources
Story so far
- ARMORY CASTLE Exploits BeyondTrust – Google Threat Intelligence
first report, added to CISA KEV - BeyondTrust patches zero-day exploited in attacks since August – BleepingComputer
exploited in attacks, patch / fix released - China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers – The Hacker News
attacker named - China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns – Infosecurity Magazine
- BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert – CSO Online
- Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day – SecurityWeek
- Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day – The Record
- China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign – Cybersecurity Dive
- Prolific Chinese espionage group exploits BeyondTrust zero-day – CyberScoop
- BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs – Dark Reading
Fact-checked against the sources above before publishing. AI-assisted script, synthetic voice, human-approved. Found an error? Tell us.
