Act
active
ARMORY CASTLE (PRC-nexus) Exploits BeyondTrust Remote Support as Zero-Day
- Engineer — Act: BeyondTrust Remote Support appliances are confirmed exploited in the wild via arbitrary file upload (CVE-2026-102764); a public PoC is on GitHub and Mandiant’s IR confirms active exploitation since August 2026 — patch immediately and audit appliance logs (access, syslog, messages, thin-scc, brain, SSL) for evidence of post-exploitation activity.
- SOC/IR — Act: Mandiant’s IR engagement documents ARMORY CASTLE (formerly UNC5221) privilege escalation and persistence on compromised BeyondTrust appliances — hunt for anomalous activity in those appliance log files dating back to late August 2026 and prepare detections for broader opportunistic exploitation expected post-disclosure.
- Leader — Act: A named PRC-nexus espionage actor exploited this enterprise remote-access product as a zero-day for weeks before disclosure; confirm whether your organization runs BeyondTrust Remote Support, verify patch and compromise-check status with your team, and prepare a brief for leadership ahead of likely broader news coverage.
- Signals: CVE-2026-102764 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.