Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day

An alleged Chinese state-backed group is using a new zero-day in BeyondTrust software to conduct espionage attacks. 

BeyondTrust, Mandiant and Google Threat Intelligence Group (GTIG) confirmed the zero-day on Thursday evening, publishing incident reports detailing attacks involving the bug.

The identity security company said the vulnerability affects its Remote Support appliances that enable IT teams to securely access and troubleshoot remote endpoints. A patch has been released addressing the issue and several mitigations are available. Other cybersecurity firms have since confirmed exploitation. 

The company said it was first tipped off to the bug — tagged as CVE-2026-102764 — on September 27, when an attack against another vendor’s edge appliances became public and sparked an investigation into a similar issue. Mandiant also warned BeyondTrust of a potential vulnerability, sending the company’s engineering team on a hunt that led them back to a zero-day exploited on August 29. 

Mandiant incident responders said the attackers were able to escalate their privileges after exploiting the bug, moving laterally within the victim’s network and establishing a deeper foothold. 

They noted that the group behind the attacks — which they call Armory Castle or UNC5221 — “leveraged a deep understanding of BeyondTrust appliance internals” due to their abuse of proprietary tools. Mandiant saw the group use custom malware they call Sawfly and Bareclaw. 

The threat actors found a way to get every credential the appliance stored and were able to modify files that survive reboots and configuration resets.

Mandiant warned that any vulnerable appliance that was reachable from the internet should be treated as potentially compromised until it has been reviewed.

‘Long-term intelligence collection’

BeyondTrust confirmed Mandiant’s assessment that Armory Castle is a Chinese “state-sponsored espionage operation focused on long-term intelligence collection.” 

“ARMORY CASTLE’s documented targets include legal services, SaaS providers, business-process outsourcers, technology companies, and government,” the company said, noting that researchers believe the group targets technology firms to help with the discovery of other zero-day exploits.  

The group was previously responsible for exploiting multiple vulnerabilities in popular edge devices and was known to use passive backdoors and other novel tools to sustain their access to breached systems. 

The group has been active since October 2023 and Google said they have “targeted a wide range of countries and verticals during their operations.”

“In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed,” they said. 

“It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764.”

Google compared the situation to previous incidents where the same threat actors conducted widespread exploitation of two bugs affecting products from IT firm Ivanti following their disclosure. 

Armory Castle was also previously implicated in exploiting zero-days affecting Citrix as well as multiple issues in Ivanti products, including CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282.

“In 2025, Mandiant reported that the actor took an Ivanti patch for a flaw that had been rated low risk, studied it, and turned it into working remote code execution against unpatched appliances,” BeyondTrust said. 

“The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched.”

Last year, Mandiant and multiple U.S. agencies warned about activity from the group targeting governments, legal firms, software-as-a-service providers and technology companies.