china espionage2 articles
China's Armory Castle Hackers Quietly Owned BeyondTrust Servers for Weeks Before Anyone Noticed
A China-linked cyber espionage group called Armory Castle exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support in late August 2026, gaining unauthorised access to self-hosted appliances through an improper origin validation flaw in an internal messaging component. Following successful exploitation, the group deployed a PHP web shell, stole credentials, escalated privileges, moved laterally to downstream systems, and used a custom SOCKS5 proxy tool to tunnel traffic while systematically deleting logs to evade detection. BeyondTrust has since patched the flaw for SaaS customers and released a manual update for self-hosted users, urging that any internet-facing appliance running a vulnerable version during the exploitation window be treated as potentially compromised.
Fire Ant Goes Deeper: China-Linked Hackers Hit Cisco Routers, TACACS Servers and Linux Hosts
A China-linked cyber espionage group called Fire Ant (strongly overlapping with UNC3886) has expanded its campaign to compromise Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, turning them into credential-harvesting and network surveillance platforms. The attackers deployed custom malware to capture network traffic, steal authentication credentials via a novel library-injection technique, and actively suppress logs, security telemetry, and audit records to hinder detection and forensic investigation. The activity mirrors tactics attributed to Salt Typhoon in a separate CISA advisory, highlighting a broader Chinese espionage trend of targeting network infrastructure devices to gain persistent, privileged visibility into high-value networks.