China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
Summary
A China-linked hacking group, Armory Castle, exploited a zero-day vulnerability in BeyondTrust Remote Support in late August 2026. The vulnerability, CVE-2026-102764, with a CVSS score of 9.3, allowed attackers to take control of remote support servers.
IFF Assessment
The exploitation of a critical vulnerability by a nation-state-linked group poses a significant threat to organizations using the affected software.
Severity
The CVSS score of 9.3 indicates a critical vulnerability due to improper origin validation in an internal messaging component, allowing for remote takeover of servers.
Defender Context
This incident highlights the ongoing threat from sophisticated actors targeting widely used remote access solutions. Defenders should prioritize patching BeyondTrust Remote Support and monitor for any signs of compromise, as such vulnerabilities can lead to significant data access and further network infiltration.