China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

China-linked cyber espionage group Armory Castle exploited a zero-day vulnerability in BeyondTrust Remote Support to gain remote access to appliances. The vulnerability, tracked as CVE-2026-102764, allowed for file operations and subsequent remote access. The group leverages commercial VPN exit nodes and compromised routers to blend into regular traffic and employs various techniques to evade detection, including log deletion and exploitation of proprietary tools.