> TritonInfoSec News
Home / Oct 17, 2026 / Story
0
#1 The Hacker News general October 16, 2026 at 06:55 UTC

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

By [email protected] (The Hacker News)

AI Summary

The China-nexus APT group Armory Castle (formerly UNC5221/Warp Panda) exploited CVE-2026-102764 (CVSS 9.3), an improper origin validation flaw in BeyondTrust Remote Support, as a zero-day beginning in late August 2026. The group deployed custom tools, deleted logs to cover tracks, and joins a pattern of Chinese espionage actors targeting edge devices — the same group previously compromised Ivanti and Citrix customers. Security teams running BeyondTrust Remote Support should patch immediately and audit for indicators of compromise dating back to August.

Read full article → https://thehackernews.com/2026/10/china-linked-hac…

Relevance score: 92.0/100

# More from October 17

  1. 2
    Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor The Hacker News
  2. 3
    Targeted ads delivered 0-click exploits to install mercenary malware Ars Technica Security
  3. 4
    Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory The Hacker News
  4. 5
    OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks SecurityWeek
  5. 6
    Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis SecurityWeek
  6. 7
    BAE Systems cyberattack disrupts US federal court operations BleepingComputer
  7. 8
    PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions The Hacker News
  8. 9
    GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories The Hacker News
  9. 10
    Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers BleepingComputer