Armory Castle's BeyondTrust Zero-Day Campaign: What Security Teams Must Do Now
Beginning August 29, a prolific Chinese state-sponsored espionage group—tracked by Mandiant and Google Threat Intelligence Group (GTIG) as Armory Castle (formerly UNC5221)—exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support. The attackers escalated privileges, moved laterally across compromised networks, and maintained stealthy persistent access for nearly a month before detection on September 28. BeyondTrust patched self-hosted instances on October 8 and auto-updated cloud versions the same day. Targets span government, legal services, technology firms, and business-process outsourcers across multiple regions, with researchers warning of broader potential exposure given the zero-day's pre-disclosure exploitation window. Armory Castle's campaign continues a well-established pattern of targeting edge and remote-access security products—Ivanti, Citrix NetScaler, and now BeyondTrust—that typically lack EDR coverage. The group's tradecraft includes per-victim infrastructure rotation and dwell times averaging hundreds of days, raising urgent concern for organizations relying on perimeter-based security without zero-trust network segmentation or east-west traffic visibility.
Kill Chain
