Our takeArmory Castle (China-nexus) used the BeyondTrust Remote Support zero-day (CVE-2026-102764) in late August for initial access, custom tooling, and log wiping. Confirmed exploitation; patch immediately if you run on-prem Remote Support.Security Resilience desk
Sources (3)
- hackernews · hackernews
- cert_bund · cert_bund
- securityweek · securityweek
What this means for you — Security leader:BeyondTrust Remote Support on-prem customers: apply the patch for CVE-2026-102764 immediately and review logs for suspicious remote-support sessions from late August onward.
What this means for you — Lean IT orgs:If you run BeyondTrust Remote Support yourself, update it right away. Most teams using only the cloud version or another remote-support tool can ignore this one.
What this means for you — MSP:Audit every client running on-prem BeyondTrust Remote Support; deploy the CVE-2026-102764 patch and hunt for Armory Castle artifacts in logs from late August.
What this means for you — Researcher:Armory Castle (UNC5221) used CVE-2026-102764 as a zero-day in late August; the improper origin validation flaw (CVSS 9.3) let them take over Remote Support servers, deploy tools, and wipe logs.