China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign

The Hacker News reports that the group, tracked as Armory Castle (previously UNC5221 or Warp Panda)[2], exploited the flaw. The outlet says the vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component[2].According to a timeline of events shared by BeyondTrust[2] and reported by The Hacker News, the first exploitation hit a single self-hosted Remote Support appliance on August 29, 2026[2]. SOC Prime reports that BeyondTrust's timeline also listed one BeyondTrust-hosted Remote Support instance[3].CSO Online reports that Mandiant observed the attacker drop a PHP web shell called SAWFLY about 11 minutes after the first malicious request[4], then gain root and try to dump the appliance's credential vault.GTIG analyst Kelli Vanderlee told Cybersecurity Dive that GTIG is "aware of only a small number of impacted organizations at this time"[1], but said more may have been compromised before disclosure. Cybersecurity Dive reports that CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog[1].BleepingComputer reports that BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8[5], and that self-hosted installations without automatic updates must be patched by hand.Mandiant said in its post, as quoted by CSO Online, that exposed vulnerable appliances "should be treated as potentially compromised until it has been reviewed"[4].