China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign

The Hacker News reports that the flaw, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component[2]. According to CSO Online, Mandiant and Google attribute the attacks to ARMORY CASTLE, a suspected PRC-nexus espionage actor formerly tracked as UNC5221[3].SOC Prime reports that BeyondTrust's threat hunt identified the activity on September 28[4]. According to the same report, the patch was released to customers on October 8, SaaS deployments were fully patched by October 9, and coordinated public disclosure occurred on October 15[4].CSO Online reports that the actor tried several variations of bt-secrets, a proprietary BeyondTrust command-line utility, to dump the appliance's credential vault[3], and later deleted more than a dozen system, web server, and application logs[3].GTIG's Kelli Vanderlee told Cybersecurity Dive that "it is possible that additional organizations were also compromised prior to the disclosure"[1].Google and Mandiant told CSO Online's readers in a blog post that "organizations should prepare for potential widespread exploitation following this disclosure"[3]. BeyondTrust said, according to The Hacker News, that once a flaw is public, "the actor typically moves to broad exploitation of every instance still unpatched"[2].Cybersecurity Dive reports that CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog[1]. According to BleepingComputer, Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online[5].