Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
BeyondTrust, Mandiant and Google confirmed that suspected Chinese espionage group Armory Castle, also tracked as UNC5221, exploited zero-day CVE-2026-102764 in BeyondTrust Remote Support appliances. Activity was traced to August 29, 2026, and a patch plus mitigations are available. Attackers escalated privileges, moved laterally, stole every stored credential and installed custom malware called Sawfly and Bareclaw that survives reboots and resets. Google warns the group often shifts from selective zero-day use to broad exploitation after disclosure, as it did with Ivanti flaws CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.
- CVE-2026-102764 affects internet-reachable BeyondTrust Remote Support appliances.
- Exploitation was traced to August 29 after a September 27 tip.
- Attackers stole stored credentials and deployed Sawfly and Bareclaw.
- Mandiant says exposed appliances should be treated as compromised.
- The group previously mass-exploited Ivanti and Citrix edge flaws.
Vulnerabilities mentionedAll →
- CVE-2024-218879.1100%Command Injection RCE in Ivanti Connect Secure and Policy Securepublished · Ivanti Connect Secure (ICS, formerly Pulse Connect Secure) KEV ransomware PoC
Full article617 words · extracted from therecord.media · click to collapse
An alleged Chinese state-backed group is using a new zero-day in BeyondTrust software to conduct espionage attacks. BeyondTrust, Mandiant and Google Threat Intelligence Group (GTIG) confirmed the zero-day on Thursday evening, publishing incident reports detailing attacks involving the bug. The identity security company said the vulnerability affects its Remote Support appliances that enable IT teams to securely access and troubleshoot remote endpoints. A patch has been released addressing the issue and several mitigations are available. Other cybersecurity firms have since confirmed exploitation. The company said it was first tipped off to the bug — tagged as CVE-2026-102764 — on September 27, when an attack against another vendor's edge appliances became public and sparked an investigation into a similar issue. Mandiant also warned BeyondTrust of a potential vulnerability, sending the company’s engineering team on a hunt that led them back to a zero-day exploited on August 29. Mandiant incident responders said the attackers were able to escalate their privileges after exploiting the bug, moving laterally within the victim’s network and establishing a deeper foothold. They noted that the group behind the attacks — which they call Armory Castle or UNC5221 — “leveraged a deep understanding of BeyondTrust appliance internals” due to their abuse of proprietary tools. Mandiant saw the group use custom malware they call Sawfly and Bareclaw. The threat actors found a way to get every credential the appliance stored and were able to modify files that survive reboots and configuration resets. Mandiant warned that any vulnerable appliance that was reachable from the internet should be treated as potentially compromised until it has been reviewed. BeyondTrust confirmed Mandiant’s assessment that Armory Castle is a Chinese “state-sponsored espionage operation focused on long-term intelligence collection.” “ARMORY CASTLE’s documented targets include legal services, SaaS providers, business-process outsourcers, technology companies, and government,” the company said, noting that researchers believe the group targets technology firms to help with the discovery of other zero-day exploits. The group was previously responsible for exploiting multiple vulnerabilities in popular edge devices and was known to use passive backdoors and other novel tools to sustain their access to breached systems. The group has been active since October 2023 and Google said they have “targeted a wide range of countries and verticals during their operations.” “In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed,” they said. “It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764.” Google compared the situation to previous incidents where the same threat actors conducted widespread exploitation of two bugs affecting products from IT firm Ivanti following their disclosure. Armory Castle was also previously implicated in exploiting zero-days affecting Citrix as well as multiple issues in Ivanti products, including CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282. “In 2025, Mandiant reported that the actor took an Ivanti patch for a flaw that had been rated low risk, studied it, and turned it into working remote code execution against unpatched appliances,” BeyondTrust said. “The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched.” Last year, Mandiant and multiple U.S. agencies warned about activity from the group targeting governments, legal firms, software-as-a-service providers and technology companies. ‘Long-term intelligence collection’
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.