Beyondtrust on CuraSec

ARMORY CASTLE (PRC-nexus) Exploits BeyondTrust Remote Support as Zero-Day

Fri, 16 Oct 2026 15:21:49 +0000

Engineer — Act: BeyondTrust Remote Support appliances are confirmed exploited in the wild via arbitrary file upload (CVE-2026-102764); a public PoC is on GitHub and Mandiant’s IR confirms active exploitation since August 2026 — patch immediately and audit appliance logs (access, syslog, messages, thin-scc, brain, SSL) for evidence of post-exploitation activity.
SOC/IR — Act: Mandiant’s IR engagement documents ARMORY CASTLE (formerly UNC5221) privilege escalation and persistence on compromised BeyondTrust appliances — hunt for anomalous activity in those appliance log files dating back to late August 2026 and prepare detections for broader opportunistic exploitation expected post-disclosure.
Leader — Act: A named PRC-nexus espionage actor exploited this enterprise remote-access product as a zero-day for weeks before disclosure; confirm whether your organization runs BeyondTrust Remote Support, verify patch and compromise-check status with your team, and prepare a brief for leadership ahead of likely broader news coverage.
Signals: CVE-2026-102764 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources

Fri, 16 Oct 2026 15:21:49 +0000

Engineer — Act: Active zero-day exploitation with a public PoC on GitHub and CVSS 9.3 — patch BeyondTrust Remote Support immediately and audit access logs for unauthorized sessions dating back to late August 2026.
SOC/IR — Act: Armory Castle (China-nexus, formerly UNC5221) actively exploited this for remote support server takeover — hunt for anomalous sessions or lateral movement originating from BeyondTrust infrastructure since late August 2026 and sweep for any published IOCs from this campaign.
Leader — Act: A China-linked espionage group used this as a zero-day against remote support servers — confirm whether your organization runs BeyondTrust Remote Support, request a vendor statement on incident scope and affected versions, and brief leadership before this surfaces in broader news coverage.
Signals: CVE-2026-102764 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources

Fri, 16 Oct 2026 15:21:49 +0000

Engineer — Act: BeyondTrust Remote Support is a PAM/privileged access tool common in enterprise environments; active exploitation since late August means exposure window is already months long — patch immediately and audit RS session logs since late August for unauthorized activity.
SOC/IR — Act: PAM/remote-support appliances are high-value pivot points; treat any BeyondTrust RS instance as potentially compromised since late August — hunt for anomalous privileged sessions, unexpected account creation, or lateral movement originating from RS hosts.
Leader — Act: Confirm whether BeyondTrust Remote Support is in your environment, request a vendor attestation on incident scope, and brief leadership — a compromised PAM tool implies potential access to all systems it manages, which is a material risk requiring same-week escalation.