As cited
Copy frozen at (site build).
threat intel
ARMORY CASTLE Exploits BeyondTrust
On October 15, Mandiant discovered that ARMORY CASTLE, a suspected People's Republic of China-nexus espionage group, exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August before the vendor disclosed the vulnerability. The attackers deployed custom webshell SAWFLY and tunneler BARECLAW to achieve root-level persistence, harvest credentials from the appliance vault, and pivot to downstream systems. Mandiant released detailed technical analysis, detection rules, and remediation guidance, warning that widespread opportunistic exploitation is likely following public disclosure.
Why it matters: Organizations running BeyondTrust Remote Support (on-premises or SaaS) must immediately patch CVE-2026-102764 or isolate appliances to prevent credential theft and lateral movement, since the vulnerability allows unauthenticated file operations leading to host control and access to all stored credentials; any internet-facing appliance on a vulnerable version during the August-October window should be assumed compromised pending forensic review.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
ARMORY CASTLE Exploits BeyondTrust
On October 15, Mandiant discovered that ARMORY CASTLE, a suspected People's Republic of China-nexus espionage group, exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August before the vendor disclosed the vulnerability. The attackers deployed custom webshell SAWFLY and tunneler BARECLAW to achieve root-level persistence, harvest credentials from the appliance vault, and pivot to downstream systems. Mandiant released detailed technical analysis, detection rules, and remediation guidance, warning that widespread opportunistic exploitation is likely following public disclosure.
Why it matters: Organizations running BeyondTrust Remote Support (on-premises or SaaS) must immediately patch CVE-2026-102764 or isolate appliances to prevent credential theft and lateral movement, since the vulnerability allows unauthenticated file operations leading to host control and access to all stored credentials; any internet-facing appliance on a vulnerable version during the August-October window should be assumed compromised pending forensic review.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
ARMORY CASTLE Exploits BeyondTrust
On October 15, Mandiant discovered that ARMORY CASTLE, a suspected People's Republic of China-nexus espionage group, exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August before the vendor disclosed the vulnerability. The attackers deployed custom webshell SAWFLY and tunneler BARECLAW to achieve root-level persistence, harvest credentials from the appliance vault, and pivot to downstream systems. Mandiant released detailed technical analysis, detection rules, and remediation guidance, warning that widespread opportunistic exploitation is likely following public disclosure.
Why it matters: Organizations running BeyondTrust Remote Support (on-premises or SaaS) must immediately patch CVE-2026-102764 or isolate appliances to prevent credential theft and lateral movement, since the vulnerability allows unauthenticated file operations leading to host control and access to all stored credentials; any internet-facing appliance on a vulnerable version during the August-October window should be assumed compromised pending forensic review.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
ARMORY CASTLE Exploits BeyondTrust
On October 15, Mandiant discovered that ARMORY CASTLE, a suspected People's Republic of China-nexus espionage group, exploited CVE-2026-102764 in BeyondTrust Remote Support appliances as a zero-day in late August before the vendor disclosed the vulnerability. The attackers deployed custom webshell SAWFLY and tunneler BARECLAW to achieve root-level persistence, harvest credentials from the appliance vault, and pivot to downstream systems. Mandiant released detailed technical analysis, detection rules, and remediation guidance, warning that widespread opportunistic exploitation is likely following public disclosure.
Why it matters: Organizations running BeyondTrust Remote Support (on-premises or SaaS) must immediately patch CVE-2026-102764 or isolate appliances to prevent credential theft and lateral movement, since the vulnerability allows unauthenticated file operations leading to host control and access to all stored credentials; any internet-facing appliance on a vulnerable version during the August-October window should be assumed compromised pending forensic review.
- Source published
- First seen by Cybersecurity Tracker