China-Linked Hackers Exploit BeyondTrust Zero-Day

A group of cyber spies with links to China, known as Armory Castle, has exploited a newly discovered vulnerability in BeyondTrust Remote Support. This vulnerability, classified as CVE-2026-102764, was identified as a zero-day at the end of August 2026. The CVSS score for this security flaw is 9.3, indicating a high level of risk. The vulnerability arises from improper origin validation in an internal messaging component of BeyondTrust. This flaw allows attackers to take control of remote support servers, posing significant security risks for affected companies.

BeyondTrust, formerly known as Bomgar, is a provider of remote support and privileged access management solutions. Armory Castle, also known by the names UNC5221 or Warp Panda, has made a name for itself through targeted attacks on businesses and government agencies. The group is known for using advanced techniques to infiltrate networks and steal sensitive data. Exploiting the CVE-2026-102764 vulnerability could be part of a broader strategy for information gathering. BeyondTrust officially announced the vulnerability on October 15, 2026.

The announcement noted that the vulnerability is actively being exploited and that affected customers should urgently take measures to secure their systems. BeyondTrust has already released a patch to address the vulnerability. The discovery of this security flaw has drawn the attention of security experts who are analyzing the impact on businesses worldwide. The possibility that attackers could access internal systems through remote support servers presents a significant risk.

Companies using BeyondTrust solutions are urged to update their systems immediately. Cybersecurity firm Mandiant has reported that attacks by Armory Castle have increased in recent months. The group has focused on companies in critical infrastructure and technology sectors. Exploiting the BeyondTrust vulnerability could further enhance the efficiency of their attacks. The security community has emphasized the importance of regular updates and patches to prevent such attacks.

Experts warn that companies that do not act proactively are at increased risk. The vulnerability could potentially affect thousands of organizations that rely on remote support solutions. The CVE-2026-102764 vulnerability is an example of the ongoing challenges in cybersecurity. Attackers often exploit newly discovered vulnerabilities to infiltrate systems and steal data.

The need to strengthen security measures is further underscored by such incidents. BeyondTrust's response to the discovery of the vulnerability demonstrates the urgency with which companies must respond to security threats. The release of the patch is a step in the right direction; however, the question remains how many companies will actually respond in a timely manner. According to BeyondTrust, over 10,000 systems worldwide are already affected.