Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August.
Mandiant researchers said a likely Chinese government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multiple tactics to escalate privileges, hop around the compromised network and evade detection.
The same threat group has repeatedly exploited a series of defects in Ivanti products since 2023, a Citrix NetScaler zero-day widely known as CitrixBleed, and last year’s Brickstorm campaign that had an average dwell time of 400 days — all resulting in sweeping attack sprees.
“We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure,” Kelli Vanderlee, senior analyst at Google Threat Intelligence Group, said in an email.
Mandiant warned organizations to “prepare for potential widespread exploitation,” adding that Armory Castle and other threat groups previously conducted broad, opportunistic exploitation following public vulnerability disclosures.
Mandiant and GTIG released their analysis of Armory Castle and its latest campaign as BeyondTrust publicly disclosed the vulnerability in its Remote Support product Thursday. The company’s security said it released a patch for the exploited defect for self-hosted customers Oct. 8 and automatically applied the update to cloud-based versions of the product that same day.
BeyondTrust, which conducted its own investigation and coordinated with Mandiant on an investigation involving a self-hosted customer that was compromised, noted Armory Castle’s prowess.
“This threat actor rotates its infrastructure and tooling for every victim, so attribution here rests on behavior. The indicators from one intrusion rarely survive to the next,” the company’s security team wrote in a blog post. “The threat actor has historically demonstrated a high degree of operational security awareness, professional practices, and tradecraft.”
A BeyondTrust spokesperson declined to answer questions about how many customers are already compromised or why it didn’t publicly disclose the actively exploited zero-day sooner, and instead referred back to its security advisory.
The company said the first known instance of zero-day exploitation occurred Aug. 29, which it detected and contained Sept. 28.
BeyondTrust also said it detected the malicious activity after zero-days were confirmed to be exploited in another security vendor’s product Sept. 27. That timing matches a round of zero-days Citrix NetScaler disclosed, following nearly two days of rampant worry and unconfirmed rumors.
BeyondTrust did not say if there is any link or overlap between the attacks targeting Citrix NetScaler, which went undetected for more than three weeks, and its remote access product.
GTIG researchers said there isn’t enough evidence to assess an overall targeting trend, but encouraged all potentially vulnerable organizations to apply the patch and hunt for pre-disclosure activity.
The threat group’s previous targets include business-process outsourcers, government, legal services, technology companies and software-as-a-service providers.
“Armory Castle remains one of the most prominent China-nexus threat actors due to its persistent targeting of various edge device technologies, use of zero-day vulnerabilities for widespread exploitation across multiple industries and regions, and its continuously expanding and evolving arsenal of tools,” said Dan Perez, technical lead at GTIG.
“This is a well-established pattern for Armory Castle,” Vanderlee said. “Targeting edge devices, which typically do not support endpoint detection and response (EDR), allows the threat actor to minimize opportunities for detection and maintain stealthy, persistent access to targeted networks.”
