Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

Chinese APT Armory Castle has been actively exploiting CVE-2026-102764, a zero-day in BeyondTrust Remote Support appliances, since August to gain root access and exfiltrate data. Organizations running BeyondTrust are at immediate risk of credential theft, lateral movement, and data loss. Attackers are deploying webshells and tunnelers while wiping logs to evade detection.

AI summary of the linked sources. Not reviewed by an editor. How this works