China-Nexus Armory Castle Exploited BeyondTrust Remote Support Zero-Day CVE-2026-102764 for Seven Weeks Before Disclosure

TL;DR

• what: Armory Castle (UNC5221), a suspected Chinese state-backed espionage group, exploited the critical zero-day CVE-2026-102764 in BeyondTrust Remote Support starting August 29, 2026.
• impact: BeyondTrust and Google confirm only a small number of victims so far, but the attackers escalated privileges, moved laterally and evaded detection, and Google says more organizations may have been compromised before disclosure.
• fix: BeyondTrust released a patch for self-hosted Remote Support on October 8 and applied it automatically to cloud instances the same day, and Mandiant and GTIG advise all exposed organizations to apply it and hunt for activity from before the disclosure.
• who: Organizations running self-hosted BeyondTrust Remote Support, especially business-process outsourcers, government, legal services, technology firms and SaaS providers that this group has targeted before.

A China-nexus espionage group with a long record of breaking into security products has done it again. Mandiant and Google Threat Intelligence Group (GTIG) report that Armory Castle, the group Mandiant used to track as UNC5221, exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. The first known exploitation was on August 29, 2026. BeyondTrust disclosed the flaw publicly on Thursday, October 16. That is 48 days, almost seven weeks, during which a privileged remote access platform was open to a nation-state operator.

BeyondTrust says it detected and contained the activity on September 28, which means the intrusion went unseen for about 30 days. The vendor shipped a patch for self-hosted customers on October 8 and pushed it to cloud-hosted instances automatically the same day. It then waited eight more days before telling the public. A BeyondTrust spokesperson declined to say how many customers were compromised or why disclosure came later, and pointed back to the company's security advisory.

What Happened

According to Mandiant, Armory Castle used CVE-2026-102764 to get into BeyondTrust Remote Support and then used several techniques to escalate privileges, move laterally through the compromised network and avoid detection. BeyondTrust ran its own investigation and worked with Mandiant on at least one compromised self-hosted customer.

Kelli Vanderlee, senior analyst at GTIG, said the known victim count is small for now, then added a warning: "given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure." Mandiant went further and told organizations to "prepare for potential widespread exploitation," because Armory Castle and other groups have a history of broad, opportunistic exploitation once a vulnerability goes public.

⚠️ Indicators will not save you here — BeyondTrust says this actor rotates its infrastructure and tooling for every victim, so attribution rests on behavior. In the company's words, "The indicators from one intrusion rarely survive to the next." Hunting based only on IOCs from another victim's intrusion is likely to miss activity in your own environment.

Timeline

• August 29, 2026: first known exploitation of CVE-2026-102764 in BeyondTrust Remote Support.
• September 27: zero-days confirmed as exploited in another security vendor's product. The timing matches a round of Citrix NetScaler zero-days.
• September 28: BeyondTrust detects and contains the malicious activity.
• October 8: patch released for self-hosted Remote Support and applied automatically to cloud instances.
• October 16: public disclosure by BeyondTrust, along with Mandiant and GTIG analysis of Armory Castle.

BeyondTrust says it found the activity after the September 27 confirmation of zero-day exploitation at another security vendor. The Citrix NetScaler zero-days disclosed around that date, after nearly two days of unconfirmed rumors, went undetected for more than three weeks. BeyondTrust did not say whether the Citrix and BeyondTrust attacks are linked or overlap. GTIG says there is not yet enough evidence to call it an overall targeting trend.

Who Is Armory Castle

This is one of the most active China-nexus groups going after edge and security infrastructure. Under the UNC5221 name it has exploited a series of Ivanti flaws since 2023, the Citrix NetScaler zero-day known as CitrixBleed, and ran last year's Brickstorm campaign, where the average dwell time was 400 days. Each of those turned into a wide attack spree.

Its past targets include business-process outsourcers, government agencies, legal services, technology companies and software-as-a-service providers. Many of those are high-value because one breach gives access to many downstream clients. Dan Perez, technical lead at GTIG, called Armory Castle "one of the most prominent China-nexus threat actors due to its persistent targeting of various edge device technologies, use of zero-day vulnerabilities for widespread exploitation across multiple industries and regions, and its continuously expanding and evolving arsenal of tools."

BeyondTrust's own assessment says the same thing: the actor "has historically demonstrated a high degree of operational security awareness, professional practices, and tradecraft."

Why Remote Access Tools Are the Target

Vanderlee called this "a well-established pattern for Armory Castle." Edge devices and remote access appliances usually cannot run endpoint detection and response (EDR), so a compromise there produces little telemetry. They also hold privileged sessions and credentials to the systems they manage, which makes them good starting points for privilege escalation and lateral movement. A remote support platform is built to reach deep into a network, and an attacker who controls it gets that reach too.

Cloud versus self-hosted — BeyondTrust applied the October 8 fix automatically to cloud-hosted Remote Support. Self-hosted deployments needed the customer to install the patch, and the one compromise BeyondTrust has described involved a self-hosted customer. Self-hosted instances that were exposed before October 8 carry the highest risk of undetected pre-disclosure access.

Vendor Fix and Guidance

The fix for CVE-2026-102764 is BeyondTrust's October 8 patch. The source reporting does not give specific version numbers, so the BeyondTrust security advisory is the authoritative reference for which builds are fixed. GTIG recommends that every potentially vulnerable organization apply the patch and also hunt for activity from before disclosure. Patching closes the entry point, but it does nothing about access the attacker already set up between August 29 and the day the patch went in. Because this actor changes its tooling for each victim, that hunt has to focus on behavior, such as unusual privilege changes and lateral movement starting from the Remote Support host, and not on shared indicators.

RedEye Assessment

The pattern is consistent. Armory Castle goes after security and access products, uses zero-days quietly for weeks, and moves into mass exploitation once details are public. Here a privileged access tool was exploitable for 48 days before the public knew, and the vendor will not say how many customers were affected. Any organization that ran self-hosted BeyondTrust Remote Support before October 8 should treat it as a possibly compromised asset until a behavior-based investigation shows otherwise. RedEye Security can assess exposure across your edge and remote access stack and run a threat hunt focused on pre-disclosure activity from this campaign.

Originally published on RedEye Threat Intelligence.