Act
active
Armory Castle Exploited BeyondTrust Remote Support Zero-Day (CVE-2026-102764)
- Engineer — Act: Active zero-day exploitation with a public PoC on GitHub and CVSS 9.3 — patch BeyondTrust Remote Support immediately and audit access logs for unauthorized sessions dating back to late August 2026.
- SOC/IR — Act: Armory Castle (China-nexus, formerly UNC5221) actively exploited this for remote support server takeover — hunt for anomalous sessions or lateral movement originating from BeyondTrust infrastructure since late August 2026 and sweep for any published IOCs from this campaign.
- Leader — Act: A China-linked espionage group used this as a zero-day against remote support servers — confirm whether your organization runs BeyondTrust Remote Support, request a vendor statement on incident scope and affected versions, and brief leadership before this surfaces in broader news coverage.
- Signals: CVE-2026-102764 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.