China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked hackers exploited a BeyondTrust zero-day to compromise remote support servers.
Run BeyondTrust Remote Support?
Get an email when a reviewed story names BeyondTrust Remote Support, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A China-nexus cyber espionage group, identified as Armory Castle (also known as UNC5221 or Warp Panda), has been actively exploiting a zero-day vulnerability in BeyondTrust Remote Support. The flaw, CVE-2026-102764, with a critical CVSS score of 9.3, involves improper origin validation in an internal messaging component. This vulnerability was leveraged by the group in late August 2026 to gain control over remote support servers.
The lesson from this incident
Full lessonA critical zero-day vulnerability (CVE-2026-102764, CVSS 9.3) in BeyondTrust Remote Support was exploited by the China-nexus threat actor Armory Castle to take over remote support servers before a patch was available. The flaw stemmed from improper origin validation in an internal messaging component — a fundamental input validation failure in a privileged, internet-facing tool. This matters significantly because remote support platforms inherently hold elevated access to endpoints across an organization, making them a high-value pivot point for espionage actors. Exploitation of zero-days in trusted security and IT management tools demonstrates that even defensive infrastructure can become an attacker's foothold if not properly isolated and monitored.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-102764