[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day-mvb3s96b":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":13,"action_required":17,"article_ids":18,"ioc_summary":20,"source_urls":21,"status":23,"expires_at":24,"created_at":25,"updated_at":26,"articles":27,"rapid":20},"92b95508-c32d-4230-8686-8ef361f4ef21","Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day","chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day-mvb3s96b","Chinese APT Armory Castle has been actively exploiting CVE-2026-102764, a zero-day in BeyondTrust Remote Support appliances, since August to gain root access and exfiltrate data. Organizations running BeyondTrust are at immediate risk of credential theft, lateral movement, and data loss. Attackers are deploying webshells and tunnelers while wiping logs to evade detection.","critical","advisory",[12],"CVE-2026-102764",[14,15,16],"Remote Support (RS)","BeyondTrust","Google","Immediately identify all BeyondTrust Remote Support appliances in your environment, patch to the latest version, and conduct forensic review for Sawfly webshell and Bareclaw tunneler artifacts. Check logs for unauthorized file operations and credential access dating back to August.",[19],"83ae37ff-8bb7-4582-803b-5fc7db7360bf",null,[22],"https:\u002F\u002Fwww.securityweek.com\u002Fchinese-apt-exploited-beyondtrust-vulnerability-as-zero-day\u002F","archived","2026-10-18T15:09:03.053+00:00","2026-10-16T15:09:07.604526+00:00","2026-10-18T16:05:10.317541+00:00",[28],{"id":19,"title":6,"url":22,"slug":29},"chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day-e2040d"]