China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

ARMORY CASTLE, a PRC-nexus espionage actor formerly known as UNC5221, exploited a critical zero-day vulnerability in BeyondTrust Remote Support in late August. Tracked as CVE-2026-102764 with a CVSS score of 9.3, the flaw involves improper origin validation. Mandiant and Google Threat Intelligence Group report that attackers gained root control and accessed credential vaults for lateral movement. Organizations using self-hosted appliances are warned to treat exposed systems as potentially compromised due to widespread exploitation risks.