BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert
Summary
A critical zero-day vulnerability, CVE-2026-102764, in BeyondTrust Remote Support has been exploited by a suspected Chinese espionage group, ARMORY CASTLE. The vulnerability allows unauthenticated attackers to gain root control and access credential vaults on self-hosted appliances. BeyondTrust has released a patch, urging immediate application by affected organizations.
IFF Assessment
The discovery and exploitation of a critical zero-day vulnerability by a state-sponsored actor poses a significant threat to organizations using the affected software, potentially leading to widespread compromise.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: February 16, 2026. Known ransomware use: Known.
Defender Context
This vulnerability allows for unauthenticated attackers to gain complete control of self-hosted BeyondTrust Remote Support appliances, posing a severe risk to credential security and network lateral movement. Defenders must prioritize patching these appliances immediately and investigate for signs of prior compromise.