A China-linked cyber espionage group called Armory Castle exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support in late August 2026, gaining unauthorised access to self-hosted appliances through an improper origin validation flaw in an internal messaging component. Following successful exploitation, the group deployed a PHP web shell, stole credentials, escalated privileges, moved laterally to downstream systems, and used a custom SOCKS5 proxy tool to tunnel traffic while systematically deleting logs to evade detection. BeyondTrust has since patched the flaw for SaaS customers and released a manual update for self-hosted users, urging that any internet-facing appliance running a vulnerable version during the exploitation window be treated as potentially compromised.
