A China-linked hacking group called Armory Castle exploited a previously unknown security vulnerability in BeyondTrust Remote Support software in late August 2026. The flaw, identified as CVE-2026-102764 with a high severity rating of 9.3, allowed attackers to perform file operations on affected appliances by improperly validating message origins in internal components. BeyondTrust released patches for cloud-based customers on October 9, 2026, while self-hosted customers running certain versions must manually update their systems to apply the fix.
After successfully compromising a Remote Support appliance, Armory Castle deployed a web shell to gain interactive access and establish persistent control. The attackers then harvested credentials, escalated privileges, and used the compromised appliance as a gateway to access downstream systems and steal sensitive documents. The group used commercial VPN services and compromised routers to mask their activity while systematically deleting logs to avoid detection. Security researchers warn that any internet-accessible appliance running vulnerable versions during the exploitation period should be considered potentially compromised.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
