Researchers from Mandiant have reported that the Chinese espionage group known as Armory Castle has exploited a critical zero-day vulnerability in BeyondTrust’s Remote Support product, with attacks traced back to late August. This development raises significant concerns for organizations using BeyondTrust solutions, as the group has demonstrated a pattern of leveraging zero-day vulnerabilities for widespread exploitation.
Armory Castle, previously tracked as UNC5221, utilized the vulnerability identified as CVE-2026-102764 to escalate privileges and navigate compromised networks while evading detection. Mandiant’s analysis indicates that the group has a history of exploiting similar vulnerabilities, including those in Ivanti products and the Citrix NetScaler zero-day, known as CitrixBleed.
Kelli Vanderlee, a senior analyst at Google Threat Intelligence Group, noted that while only a few organizations have been confirmed as impacted, the stealthy nature of the attacks suggests that more victims may exist. Mandiant has warned organizations to prepare for potential widespread exploitation, as Armory Castle has previously engaged in opportunistic attacks following public vulnerability disclosures.
BeyondTrust publicly disclosed the vulnerability on October 8, the same day it released a patch for self-hosted customers and automatically applied updates to cloud-based versions. The company conducted its own investigation in collaboration with Mandiant, identifying the first known instance of exploitation on August 29 and containing the activity by September 28.
Despite the ongoing investigation, BeyondTrust has not disclosed the number of compromised customers or the reasons for the timing of its public disclosure. The company emphasized the operational security awareness of Armory Castle, stating that the threat actor frequently rotates its infrastructure and tools, complicating attribution efforts.
As organizations assess their exposure, Mandiant and GTIG researchers recommend applying the patch and monitoring for any pre-disclosure activity. The threat group’s previous targets have included a range of sectors, such as government, technology, and legal services, highlighting its broad operational scope.
“Armory Castle remains one of the most prominent China-nexus threat actors due to its persistent targeting of various edge device technologies,” said Dan Perez, technical lead at GTIG. The group’s focus on edge devices, which often lack robust endpoint detection and response capabilities, allows it to maintain stealthy access to targeted networks.
For further details on the vulnerability and its implications, BeyondTrust has published a security advisory, which can be accessed here.
As the situation develops, organizations are urged to remain vigilant and proactive in their cybersecurity measures to mitigate potential risks associated with this ongoing threat.
