China-Linked Espionage Group Exploits BeyondTrust Remote Support Zero-Day

In late August 2026, a China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) began exploiting a zero-day vulnerability in BeyondTrust Remote Support, formerly known as Bomgar. The vulnerability, identified as CVE-2026-102764, carries a CVSS score of 9.3 and stems from improper origin validation in an internal messaging component of the remote support software.

According to reporting, the exploitation allowed the threat actor to take over remote support servers. BeyondTrust confirmed the issue and released security updates to address CVE-2026-102764. The company advised users to apply the latest patches and follow vendor hardening guidance to mitigate the risk.

The exploitation was disclosed in October 2026, with the zero-day having been active in the wild since late August. The attribution to Armory Castle aligns with reporting on China-nexus cyber espionage operations targeting remote infrastructure.