By Matt Kapko
Publication Date: 2026-10-16 17:09:00
Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August.
Mandiant researchers said a likely Chinese government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multiple tactics to escalate privileges, hop around the compromised network and evade detection.
The same threat group has repeatedly exploited a series of defects in Ivanti products since 2023, a Citrix NetScaler zero-day widely known as CitrixBleed, and last year’s Brickstorm campaign that had an average dwell time of 400 days — all resulting in sweeping attack sprees.
“We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional…
