> TritonInfoSec News
Home / Oct 18, 2026 / Story
0
#1 CyberScoop general October 16, 2026 at 17:09 UTC

Prolific Chinese espionage group exploits BeyondTrust zero-day

By Matt Kapko

AI Summary

Chinese espionage group Armory Castle (UNC5221) is actively exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764) for espionage, with the first known attack occurring approximately seven weeks ago. The group, previously responsible for compromising Ivanti and Citrix customers, is deploying custom tools while deleting logs to cover tracks. Security practitioners should prioritize patching BeyondTrust Remote Support immediately, as this threat actor has a strong track record of operationalizing edge device vulnerabilities at scale.

Read full article → https://cyberscoop.com/china-espionage-attacks-bey…

Relevance score: 92.0/100

# More from October 18

  1. 2
    Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day SecurityWeek
  2. 3
    BeyondTrust patches zero-day exploited in attacks since August BleepingComputer
  3. 4
    Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack BleepingComputer
  4. 5
    Zero-click attacks used targeted ads to deliver Candiru spyware BleepingComputer
  5. 6
    Critical BlockStrap flaw lets hackers run code on Magento servers BleepingComputer
  6. 7
    Drupal patches critical RCE flaws, warns exploits may emerge soon BleepingComputer
  7. 8
    Cybersecurity incident at BAE Systems disrupts US bankruptcy court system CyberScoop
  8. 9
    OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract The Hacker News
  9. 10
    F5, Juniper Networks Patch Critical Vulnerabilities SecurityWeek