[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9XGR2KOzeDQHmWP5hk8Ssnm2b-ciemzZfk7E4xMo_tM":3},{"article":4,"iocs":55,"watch_terms":80,"solutions":81,"lesson":180},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"83ae37ff-8bb7-4582-803b-5fc7db7360bf","Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day","chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day-e2040d","Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts. The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.","A Chinese APT, known as Armory Castle (UNC5221, Warp Panda), has been exploiting a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support appliances since August. This flaw allows for unauthorized file operations. The attackers deployed custom tools like Sawfly webshell and Bareclaw tunneler to gain root access, harvest credentials, and exfiltrate sensitive documents, while also deleting logs to cover their tracks.","Chinese APT Armory Castle exploited BeyondTrust RS vulnerability CVE-2026-102764 as a zero-day.","https:\u002F\u002Fwww.securityweek.com\u002Fchinese-apt-exploited-beyondtrust-vulnerability-as-zero-day\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002FBeyondTrust.jpeg","2026-10-16T10:53:22+00:00","2026-10-16T12:00:17.901823+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Armory Castle","threat_actor",{"name":21,"type":19},"UNC5221",{"name":23,"type":19},"Warp Panda",{"name":25,"type":26},"Remote Support (RS)","product",{"name":28,"type":29},"BeyondTrust","vendor",{"name":31,"type":29},"Google","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":32,"icon":34,"name":35,"slug":36},null,"Zero-day","zero-day",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,64,67,70,73,75,77],{"type":57,"value":58,"context":59},"cve","CVE-2026-102764","Improper validation of message origins in BeyondTrust Remote Support appliances.",{"type":61,"value":62,"context":63},"malware","Sawfly","Lightweight PHP webshell used by Armory Castle for initial access and C2 communication.",{"type":61,"value":65,"context":66},"Bareclaw","Custom SOCKS5 proxy tunneler used by Armory Castle for data encryption and traffic chaining.",{"type":57,"value":68,"context":69},"CVE-2023-4966","Previously exploited by Armory Castle (CitrixBleed).",{"type":57,"value":71,"context":72},"CVE-2023-46805","Previously exploited by Armory Castle in Ivanti Connect Secure.",{"type":57,"value":74,"context":72},"CVE-2024-21887",{"type":57,"value":76,"context":72},"CVE-2025-0282",{"type":57,"value":78,"context":79},"CVE-2026-22769","Previously exploited by Armory Castle in Dell RecoverPoint for Virtual Machines.",[31,28,25],{"controls":82,"vendors":169},[83,112,140],{"slug":84,"name":85,"problem":86,"products":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":113,"name":114,"problem":115,"products":116},"patch-management","Automated patch management","Known holes get closed in days, not months.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":113,"product_name":137,"url":138,"description":139},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":141,"name":142,"problem":143,"products":144},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[170,175],{"slug":171,"name":28,"logo_path":172,"roles":173},"beyondtrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[174],"affected",{"slug":176,"name":31,"logo_path":177,"roles":178},"google","\u002Fvendor-logos\u002Fgoogle.png",[179],"reported_by",{"slug":181,"title":182,"body":183,"framework_refs":184,"framework_notes":198},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","A Chinese advanced persistent threat group exploited a zero-day vulnerability in BeyondTrust Remote Support appliances, a privileged access management tool trusted with sensitive credentials and administrative access across enterprise environments. Because the flaw was unknown at the time of exploitation, organizations had no patch to apply, making pre-existing compensating controls — such as network segmentation, behavioral monitoring, and least-privilege access — critical lines of defense. The attackers compounded the damage by deploying webshells and tunneling tools to maintain persistence and deleting logs to hinder detection and forensic investigation. This incident underscores that remote support and privileged access tools are high-value targets that require hardened configurations, continuous monitoring, and rapid response capabilities. The ability of attackers to operate undetected for months highlights dangerous gaps in both detection coverage and incident response readiness.",[185,186,187,188,189,190,191,192,193,194,195,196,197],"CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AU-9: Protection of Audit Information","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IR-4: Incident Handling","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1070: Indicator Removal on Host","MITRE ATT&CK T1505.003: Server Software Component – Web Shell","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning",{}]