[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4JS7uvecz4MkJnE46VnlNYZsIYeon8L1LZgInBIzxqs":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0c6aecf7-69b6-4063-9414-17ccc64d3963","Prolific Chinese espionage group exploits BeyondTrust zero-day","prolific-chinese-espionage-group-exploits-beyondtrust-zero-day-e8d3d8","Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. The post Prolific Chinese espionage group exploits BeyondTrust zero-day appeared first on CyberScoop.","A suspected Chinese government-backed espionage group, known as Armory Castle (UNC5221), has exploited a zero-day vulnerability in BeyondTrust's Remote Support product. This group has a history of targeting security products, including previous exploits in Ivanti and Citrix. Researchers warn of potential widespread exploitation, urging organizations to patch and hunt for pre-disclosure activity.","Chinese espionage group Armory Castle exploits BeyondTrust zero-day.","https:\u002F\u002Fcyberscoop.com\u002Fchina-espionage-attacks-beyondtrust-zero-day-armory-castle\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F04\u002FGettyImages-1332529886.jpg","2026-10-16T17:09:09+00:00","2026-10-16T18:00:07.126131+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"Armory Castle","threat_actor",{"name":21,"type":19},"UNC5221",{"name":23,"type":24},"BeyondTrust","vendor",{"name":26,"type":24},"Mandiant",{"name":28,"type":24},"Google Threat Intelligence Group",{"name":30,"type":31},"Remote Support","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"cve","CVE-2026-102764","Exploited zero-day vulnerability in BeyondTrust Remote Support",[23,26,28],{"controls":62,"vendors":149},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"patch-management","Automated patch management","Known holes get closed in days, not months.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":54,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[150,155],{"slug":151,"name":23,"logo_path":152,"roles":153},"beyondtrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[154],"affected",{"slug":126,"name":127,"logo_path":128,"roles":156},[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":174},"chinese-espionage-group-exploits-beyondtrust-zero-day-in-remote-support-tool","Chinese Espionage Group Exploits BeyondTrust Zero-Day in Remote Support Tool","The Armory Castle (UNC5221) threat group, linked to Chinese state-sponsored espionage, exploited a zero-day vulnerability in BeyondTrust's Remote Support product — a privileged access tool trusted by organizations to manage sensitive systems. This attack follows a clear pattern of targeting widely-deployed security and remote access products, making these tools high-value entry points for nation-state actors. Zero-day exploitation means defenders had no prior patch available, making pre-disclosure threat hunting and compensating controls essential. The incident highlights that security tooling itself is a critical attack surface and must be subject to the same rigorous monitoring and segmentation as any other high-risk asset. Organizations relying on internet-facing privileged access solutions without robust anomaly detection and segmentation are especially exposed.",[163,164,165,166,167,168,169,170,171,172,173],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-2 – Flaw Remediation","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IR-4 – Incident Handling","NIST SP 800-53 RA-5 – Vulnerability Monitoring and Scanning","MITRE ATT&CK T1190 – Exploit Public-Facing Application","MITRE ATT&CK T1133 – External Remote Services","ITIL – Patch Management Process (Change Enablement)","NIST CSF DE.CM-8 – Vulnerability Scans Performed",{}]