Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
BeyondTrust, Mandiant and Google confirmed that suspected Chinese espionage group Armory Castle, also tracked as UNC5221, exploited zero-day CVE-2026-102764 in BeyondTrust Remote Support appliances. Activity was traced to August 29, 2026, and a patch plus mitigations are available. Attackers escalated privileges, moved laterally, stole every stored credential and installed custom malware called Sawfly and Bareclaw that survives reboots and resets. Google warns the group often shifts from selective zero-day use to broad exploitation after disclosure, as it did with Ivanti flaws CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.
- CVE-2026-102764 affects internet-reachable BeyondTrust Remote Support appliances.
- Exploitation was traced to August 29 after a September 27 tip.
- Attackers stole stored credentials and deployed Sawfly and Bareclaw.
- Mandiant says exposed appliances should be treated as compromised.
- The group previously mass-exploited Ivanti and Citrix edge flaws.
- Vendors
- BeyondTrustIvantiCitrix
- Products
- BeyondTrust Remote Support
- Threat actors
- Armory CastleUNC5221
- Organizations
- BeyondTrustMandiantGoogle
- Countries
- China
Coverage
oldest first · one row per article · UTC- · 14d ago
The RecordFirst report
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
Chinese espionage group Armory Castle is exploiting BeyondTrust Remote Support zero-day CVE-2026-102764.
- · 14d ago
Canadian Centre for Cyber Security
BeyondTrust security advisory (AV26-1054)
Canada's Cyber Centre warns BeyondTrust Remote Support CVE-2026-102764 is being exploited in the wild.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2025-0282 | Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 9.0 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2026-102764 | Message-origin spoofing enables file ops on BeyondTrust Remote Support | 9.3 | 19% | KEVPoC ×2 | KEV |