Suspected PRC-aligned hackers known as Armory Castle exploit a newly disclosed flaw in BeyondTrust Remote Support to gain access and establish persistence. Multiple outlets report the activity uses CVE-2026-102764 as a zero-day in late August 2026 and involves deploying custom tooling and taking steps to conceal traces.
Google and other reporting describe the vulnerability as affecting an internal messaging component, with improper origin validation cited as a key technical issue. The concern across sources is that the exploitation targets organizations using remote support software, potentially enabling compromise beyond a single system. Outlets differ mainly in emphasis: some highlight Google’s warning and the risk to critical environments, while others focus on observed tradecraft such as log and artifact deletion and the group’s identification history (including aliases such as UNC5221 or Warp Panda).
