China-Linked Group Exploits BeyondTrust Zero-Day
Armory Castle hackers used a critical BeyondTrust flaw to compromise remote support servers. Organizations using the platform should take immediate action.
TL;DR
- China-linked APT Armory Castle exploited a new zero-day in BeyondTrust Remote Support.
- The flaw, CVE-2026-102764, has a CVSS score of 9.3 and affects internal messaging components.
- The attack targeted remote support servers, potentially enabling full system takeover.
- BeyondTrust has released patches—organizations are urged to update immediately.
- This incident highlights risks in third-party remote access tools for enterprise environments.
In late August 2026, threat actors linked to China exploited a previously unknown vulnerability in BeyondTrust Remote Support. The group, known as Armory Castle (aka UNC5221 or Warp Panda), leveraged the flaw to gain unauthorized access to remote support servers.
The vulnerability, now identified as CVE-2026-102764, resides in an internal messaging component and carries a high CVSS score of 9.3. It allows attackers to bypass origin validation, potentially leading to full server compromise. This marks another example of state-sponsored adversaries targeting enterprise remote access solutions for persistent network infiltration.
Vulnerability Overview
- CVE-2026-102764 is an improper origin validation flaw in BeyondTrust Remote Support’s internal messaging system.
- It was exploited as a zero-day, meaning no patch existed at the time of the attack.
- The flaw enables attackers to execute arbitrary commands on affected systems.
- A CVSS score of 9.3 indicates critical severity and high exploitability.
Impact and Recommendations
- Organizations using BeyondTrust Remote Support should verify they are running patched versions.
- Review network logs for unusual activity around the time of exploitation attempts.
- Implement network segmentation to limit lateral movement from compromised support servers.
- Monitor for indicators of compromise (IOCs) associated with Armory Castle operations.
- Consider enhanced scrutiny for all third-party remote administration tools due to elevated risk.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.