China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

vulnerability

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

China-linked cyber espionage group Armory Castle exploited a zero-day vulnerability in BeyondTrust Remote Support to gain remote access to appliances. The vulnerability, tracked as CVE-2026-102764, allowed for file opera…

The Hacker News · 6h ago CriticalCVSS 9.3ExploitedEPSS 100%

CVE-2026-102764 CVE-2023-4966 CVE-2023-46805 zero-day remote support c2

vulnerability

Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

A Chinese state-sponsored APT group, Armory Castle (also known as UNC5221 and Warp Panda), exploited a zero-day vulnerability in BeyondTrust’s Remote Support (RS) appliance since August 29th, 2023, to gain root access an…

SecurityWeek · 2h ago CriticalCVSS 10.0KEVEPSS 100%

CVE-2026-102764 CVE-2023-4966 CVE-2023-46805 CH zero-day apt webshell

apt

Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day

A Chinese state-backed espionage group, known as Armory Castle (UNC5221), is exploiting a zero-day vulnerability in BeyondTrust’s Remote Support appliances to conduct espionage attacks.

The Record · 32m ago CriticalCVSS 9.3ExploitedEPSS 100%

CVE-2026-102764 CVE-2023-46805 CVE-2024-21887 zero-day espionage remote support

news.mlab.sh

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers