Mandiant links the BeyondTrust zero-day attacks to Armory Castle, the group behind past Ivanti and Citrix campaigns

Mandiant says the attacks exploiting CVE-2026-102764 in BeyondTrust Remote Support were carried out by a likely Chinese government-backed espionage group. Mandiant previously tracked the group as UNC5221 and now calls it Armory Castle. The same group has repeatedly exploited flaws in Ivanti products since 2023, as well as the Citrix NetScaler zero-day known as CitrixBleed. It was also behind last year's Brickstorm campaign, which had an average dwell time of 400 days. After gaining access, the attackers escalated privileges, moved laterally, deployed custom tools and deleted logs and artifacts. The flaw has a CVSS score of 9.3 and involves improper validation of message origins. It lets attackers perform file operations on Remote Support appliances up to version 26.2.3. BeyondTrust says the first exploitation occurred on August 29 against one BeyondTrust-hosted appliance and one self-hosted appliance. The company was tipped off around September 27, after an attack on another vendor's appliances became public. It produced a patch by September 30 but shipped it on October 8 after closing additional exploitation paths. All SaaS customers were patched as of October 9, and self-hosted customers on releases older than 24.3.1 must upgrade before applying the fix. Mandiant says it knows of only a small number of victims but warns that more may have been compromised. CISA has also added the flaw to its Known Exploited Vulnerabilities catalog.