BeyondTrust, Mandiant and Google Threat Intelligence Group disclosed on 15–16 October a zero-day in BeyondTrust Remote Support appliances, tracked as CVE-2026-102764, exploited as early as 29 August 2026. The actor — Mandiant's ARMORY CASTLE, also tracked as UNC5221 — used the flaw to escalate privileges on the appliance, move laterally and establish a foothold whose files survived reboots and configuration resets, and it obtained every credential the appliance stored. Mandiant reported custom malware it calls Sawfly and Bareclaw and said the group "leveraged a deep understanding of BeyondTrust appliance internals". BeyondTrust described ARMORY CASTLE as a Chinese state-sponsored espionage operation focused on long-term intelligence collection, with documented targets including legal services, SaaS providers, business-process outsourcers, technology companies and government. Google warned the actor has previously conducted widespread opportunistic exploitation immediately after edge-device disclosures and said similar attempts against this flaw are possible. A patch and mitigations are available; Mandiant advised that any vulnerable appliance reachable from the internet should be treated as potentially compromised until reviewed. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalogue on 16 October.

• Source article