Suspected China-Linked Hackers Exploit BeyondTrust Zero-Day

A China-linked group tracked as Armory Castle, previously known as UNC5221, exploited a previously unknown flaw in BeyondTrust Remote Support in late August 2026, before the vulnerability was disclosed. The critical flaw could let unauthenticated attackers perform file operations on affected appliances, potentially steal credentials, upload files, gain control of the host and use the appliance to reach connected systems. Google and Mandiant reported that attackers installed tools to maintain access and move further into victim networks, and warned that disclosure could spur broader exploitation. BeyondTrust said it had patched its SaaS customers and directed self-hosted customers to install the available update or upgrade to a supported version.