The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
InfoNews
ARMORY CASTLE Exploits BeyondTrust
- Published
- Record updated
Summary
ARMORY CASTLE, a suspected PRC-nexus espionage actor also tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August 2026 against BeyondTrust Remote Support appliances, according to Mandiant. After exploitation, the actor deployed the SAWFLY PHP webshell and the BARECLAW tunneler, escalated privileges, and deleted logs to maintain access and evade detection.
Mitigation
BeyondTrust provides security patches to remediate the vulnerability, and Mandiant strongly recommends that affected organizations apply them immediately.