[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcUCVEgfepMr-eSZ4w5Lkk6hrueKFJstLkHu-SlIYRXQ":3},{"article":4,"iocs":52,"watch_terms":57,"solutions":58,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"6edde89e-348a-4d99-826b-6360ff6d3ca2","China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers","china-linked-hackers-exploited-beyondtrust-zero-day-to-take-over-remote-support--2f4ebf","The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be exploited by a","A China-nexus cyber espionage group, identified as Armory Castle (also known as UNC5221 or Warp Panda), has been actively exploiting a zero-day vulnerability in BeyondTrust Remote Support. The flaw, CVE-2026-102764, with a critical CVSS score of 9.3, involves improper origin validation in an internal messaging component. This vulnerability was leveraged by the group in late August 2026 to gain control over remote support servers.","China-linked hackers exploited a BeyondTrust zero-day to compromise remote support servers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fchina-linked-hackers-exploited.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEic5zD5GBvYxe93igsDOMdwS6eyfDORIWio42Z9UY0enK0XKWYcQlLB9RLx3iO_V1xm8vqBxMVZ_R8Lt-xxOumO5_RIFN3hgB-yZyGGlVMypRx5lm2GJq-1c9cbzfRcjrMAIfBI67L4QUI-MwjjQjKL1RcgPnzFdYuAF3k1y2Ev-ppSmiG8sdQ5dbJkbjKR\u002Fs1600\u002Fbeyond.jpg","2026-10-16T06:55:55+00:00","2026-10-16T08:00:11.663501+00:00",9,[17,20,22,24,27],{"name":18,"type":19},"Armory Castle","threat_actor",{"name":21,"type":19},"UNC5221",{"name":23,"type":19},"Warp Panda",{"name":25,"type":26},"BeyondTrust Remote Support","product",{"name":28,"type":26},"Bomgar","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":29,"icon":31,"name":32,"slug":33},null,"Nation-state","nation-state",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":54,"value":55,"context":56},"cve","CVE-2026-102764","Improper origin validation vulnerability in BeyondTrust Remote Support",[25,28],{"controls":59,"vendors":146},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":90,"product_name":114,"url":115,"description":116},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":171},"china-linked-hackers-exploit-beyondtrust-zero-day-to-seize-remote-support-servers","China-Linked Hackers Exploit BeyondTrust Zero-Day to Seize Remote Support Servers","A critical zero-day vulnerability (CVE-2026-102764, CVSS 9.3) in BeyondTrust Remote Support was exploited by the China-nexus threat actor Armory Castle to take over remote support servers before a patch was available. The flaw stemmed from improper origin validation in an internal messaging component — a fundamental input validation failure in a privileged, internet-facing tool. This matters significantly because remote support platforms inherently hold elevated access to endpoints across an organization, making them a high-value pivot point for espionage actors. Exploitation of zero-days in trusted security and IT management tools demonstrates that even defensive infrastructure can become an attacker's foothold if not properly isolated and monitored.",[158,159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.AM-2: Software platforms and applications inventoried","NIST CSF DE.CM-7: Monitoring for unauthorized activity","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1021.011: Remote Services Abuse","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","ITIL Service Transition: Emergency Change Management",{}]