China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
China-linked Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 to seize support appliances.
86
Vendor
Mandiant
- Mentions · 7d0
- Mentions · 30d1
- All mentions19
- First seenAug 17, 2026
- Last mentioned15d ago
Timeline
19 articles · newest firstAn undercover Google analyst infiltrated a notorious supply-chain hacking gang
Google's Mandiant planted an undercover analyst inside TeamPCP, the supply-chain gang that breached 1,000+ companies via poisoned open-source packages before two Australian arrests.
88
An Undercover Google Analyst Infiltrated a Notorious Supply Chain Hacking Gang
Google revealed a Mandiant undercover analyst infiltrated TeamPCP, letting it warn hundreds of victims and disrupt the gang's supply chain attacks and extortion.
82
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
SecurityWeek roundup: ransomware developer sentenced, critical SAP flaw CVE-2026-44756, PhantomRaven npm info-stealer, WordPress mass exploitation, and AI agent security findings.
32
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.
62
One runaway AI agent racked up a $50,000 cloud bill
Mandiant's AI Risk and Resilience report details prompt injection, AI supply chain compromises, agent abuse, and a runaway agent that accrued $50,000 in cloud charges.
68
Mandiant Founder Kevin Mandia Joins Amazon Board
Amazon elected cybersecurity veteran Kevin Mandia, founder of Mandiant, to its board of directors on September 8.
40
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA
Okta finds infostealer logs contain thousands of replayable AI session tokens and API keys, letting criminals bypass MFA and access services from Google, Anthropic and OpenAI.
60
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.
75
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.
65
Threat actors are giving AI agents a bigger role in cyberattacks
Google Threat Intelligence's Q3 2026 tracker shows threat actors using AI agents for autonomous credential harvesting, including a six-hour campaign compromising thousands of credentials.
62
Mars Security brings threat intelligence to detection in real time
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
24
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Arctic Wolf tracks PREY-0058, a vishing and AitM token-theft crew targeting Microsoft 365 executives for data theft and extortion.
76
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
78
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.
65
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
Sygnia links the China-nexus Fire Ant campaign to UNC3886, showing hackers weaponized compromised Cisco IOS XR routers for espionage and wider intrusions.
70
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Google Threat Intelligence details BREEZE COMET, a financially motivated group manipulating Brazilian payment systems and banking software to conduct fraudulent transfers since 2024.
55
Details emerge on BlackFile's recent attacks on financial companies
BlackFile (UNC6671), a The Com-linked extortion crew, keeps hitting financial and med tech firms with voice-phishing IT-support scams and ~$3 million demands.
70
Brand Impersonation Takedown: From Whack-a-Mole to Managed Response
Mandiant-tracked group UNC3753 impersonated US professional services firms' brands in 2026; Cyble urges managed takedowns over manual abuse reports.
50
Related CVEs
by mentions- CVE-2026-10276419%9.3Message-origin spoofing enables file ops on BeyondTrust Remote Support
- CVE-2024-21887100%9.1Command Injection RCE in Ivanti Connect Secure and Policy Secure
- CVE-2025-0282100%9.0Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways
- CVE-2023-46805100%8.2Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
- CVE-2023-4966100%7.5Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway
- CVE-2026-44756<1%10.0Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing
- CVE-2026-15315<1%8.7Authentication Bypass via Challenge Validation Flaw in TP-Link Tapo C120/C200 Cameras
- CVE-2026-15316<1%7.1Unauthenticated Input Validation DoS in TP-Link Tapo C200 v5 Configuration Service
Appears with
- Mandiantorganization · 9
- Googlevendor · 9
- Google Threat Intelligence Grouporganization · 9
- Microsoftvendor · 5
- CrowdStrikevendor · 4
- TeamPCPthreat actor · 4
- Googleorganization · 3
- Google Threat Intelligence Groupvendor · 3
- Pinkthreat actor · 3
- ShinyHuntersthreat actor · 3
- UNC6671threat actor · 3
- Shai-Huludmalware · 2
- Microsoft 365product · 2
- Redactthreat actor · 2
- Helixthreat actor · 2
- FBIorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.