# Chinese State-Backed Group Exploits New BeyondTrust Zero-Day for Espionage An alleged Chinese state-backed group is leveraging a novel zero-day vulnerability in **BeyondTrust** software to conduct sophisticated espionage attacks. The identity security company, alongside **Mandiant** and **Google Threat Intelligence Group (GTIG)**, confirmed the zero-day's exploitation, publishing detailed incident reports. ## The Vulnerability: CVE-2026-102764 The vulnerability, identified as **CVE-2026-102764**, affects **BeyondTrust** Remote Support appliances. These devices are critical for IT teams, enabling secure remote access and troubleshooting of endpoints. A patch has since been released, and several mitigation strategies are available to address the issue. **BeyondTrust** was initially alerted to the bug on September 27, following an attack on another vendor's edge appliances that prompted an investigation into a similar issue. Further warnings from **Mandiant** led **BeyondTrust's** engineering team to discover the zero-day, which had been actively exploited since August 29. ## Attack Methodology and Impact **Mandiant's** incident responders observed the attackers, designated as **Armory Castle** or **UNC5221**, exploiting the bug to escalate privileges, move laterally within victim networks, and establish a persistent foothold. The group demonstrated a profound understanding of **BeyondTrust** appliance internals, leveraging proprietary tools and custom malware known as **Sawfly** and **Bareclaw**. Threat actors successfully extracted every credential stored on the compromised appliances and modified files designed to persist across reboots and configuration resets. **Mandiant** strongly advises that any vulnerable appliance reachable from the internet should be considered compromised until a thorough review and remediation have been completed. ## 'Long-Term Intelligence Collection' **BeyondTrust** has corroborated **Mandiant's** assessment, confirming that **Armory Castle** is a Chinese state-sponsored espionage operation focused on long-term intelligence collection. Their documented targets span legal services, SaaS providers, business-process outsourcers, technology companies, and government entities. Researchers believe the group specifically targets technology firms to aid in the discovery of additional zero-day exploits. **Armory Castle** has been active since October 2023, targeting a wide range of countries and industry verticals. The group has a history of exploiting multiple vulnerabilities in popular edge devices, often employing passive backdoors and other advanced tools to maintain access to breached systems. ## Pattern of Exploitation and Warning **Google** highlights a concerning pattern: **Armory Castle** often conducts widespread, opportunistic exploitation of vulnerabilities once they become public, especially after having selectively exploited them as zero-days. This allows them to infiltrate organizations rapidly before patches can be deployed. A similar widespread exploitation attempt associated with **CVE-2026-102764** is anticipated. This mirrors previous incidents where **Armory Castle** exploited two bugs affecting **Ivanti** products following their disclosure. The group has also been implicated in exploiting zero-days in **Citrix** and multiple **Ivanti** vulnerabilities, including **CVE-2023-46805**, **CVE-2024-21887**, and **CVE-2025-0282**. In a notable incident from 2025, **Mandiant** reported that the actor analyzed an **Ivanti** patch for a low-risk flaw, reverse-engineering it into a working remote code execution exploit against unpatched appliances. This demonstrates **Armory Castle's** strategic approach: selective zero-day exploitation against chosen targets, followed by broad exploitation once the vulnerability is public. Last year, **Mandiant** and several U.S. agencies issued warnings about **Armory Castle's** activities, which included targeting governments, legal firms, SaaS providers, and technology companies with backdoors like **Brickstorm**.