mandiant3 articles
China's Armory Castle Hackers Quietly Owned BeyondTrust Servers for Weeks Before Anyone Noticed
A China-linked cyber espionage group called Armory Castle exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support in late August 2026, gaining unauthorised access to self-hosted appliances through an improper origin validation flaw in an internal messaging component. Following successful exploitation, the group deployed a PHP web shell, stole credentials, escalated privileges, moved laterally to downstream systems, and used a custom SOCKS5 proxy tool to tunnel traffic while systematically deleting logs to evade detection. BeyondTrust has since patched the flaw for SaaS customers and released a manual update for self-hosted users, urging that any internet-facing appliance running a vulnerable version during the exploitation window be treated as potentially compromised.
Google Ditches the Industry Naming Pact and Builds Its Own Threat Actor Taxonomy
Google has launched its own two-word naming taxonomy for cybercrime groups, following its merger of Mandiant into the Google Threat Intelligence Group, assigning category terms such as CASTLE (China), RELIC (Russia), and COMET (non-state actors) as the second word. The move appears to contradict earlier reports that Google and Mandiant were open to joining a Microsoft and CrowdStrike-led industry initiative to standardise threat actor naming, which aimed to reduce the confusion caused by the same groups carrying up to ten different names across vendors. Google claims its system is intentionally simple to allow easy mapping to other taxonomies, though critics may see it as yet another competing schema adding to the existing fragmentation.
KnowledgeDeliver Zero-Day Let Attackers Walk In With Keys They Already Had
Threat actors exploited a zero-day vulnerability (CVE-2026-5426) in KnowledgeDeliver, a widely used LMS, by leveraging hardcoded machineKey values in its ASP.NET configuration to mount ViewState deserialization attacks and deploy Godzilla web shells. The attackers used the web shells to modify system permissions, inject malicious scripts, and ultimately install a targeted Cobalt Strike backdoor, as reported by Mandiant. All KnowledgeDeliver deployments prior to February 24, 2026 are potentially at risk, and organisations are advised to rotate machine keys, restrict LMS access, and monitor for signs of intrusion.