The actor cluster now catalogued by Mandiant as "Armory Castle" — a grouping that has also carried the designations UNC5221 and UTA0178 — sits within a broader set of threat actors tied to China, one that began exploiting an unpatched vulnerability in BeyondTrust Remote Support appliances as an attack vector from 29 August 2026.
Catalogued under the identifier CVE-2026-102764 and assigned a CVSS rating of 9.3, the flaw stems from an internal messaging component whose origin-validation logic for incoming messages was found to be insufficient. Remote access tools give technology staff the ability to operate and manage machines — whether desktop computers or servers — without being physically present at those devices. According to its own figures, BeyondTrust puts its customer base at upwards of 20,000 organisations, with three-quarters of the Fortune 100 counted among them.
A pre-authentication vulnerability carrying a 9.9 CVSS score was identified in both Remote Support and its companion product, Privileged Remote Access, after an AI agent examined the software earlier that year. Roughly 11,000 instances of Remote Support — spanning both cloud deployments and on-premises installations — were publicly reachable via the internet, according to what investigators documented at that point.
Threat intelligence findings published jointly by Mandiant and Google's Threat Intelligence Group revealed that a custom PHP webshell, designated SAWFLY, was introduced into the targeted environment by Armory Castle within eleven minutes of the vulnerability being turned into an active exploit. Unauthorised access to the appliance led to a systematic sweep of its internal database, from which login credentials, API keys, and endpoint access tokens were extracted.
Persistence on the target network was secured through a planted script, after which log files spanning the system, web server, and application layers were wiped and access rights were elevated from a routine service account up to full administrative control. Through those capabilities, the malware could open remote sessions with systems further along the network, map out internal infrastructure, and pull confidential files from the affected machines before transferring them elsewhere.
A second proprietary utility — BARECLAW, purpose-built for SOCKS5 tunnelling — was brought into the operation alongside the first. Mandiant's investigators concluded that the person or group behind the intrusion possessed detailed, hands-on knowledge of how BeyondTrust's internal architecture had been designed and set up.
A fix for CVE-2026-102764 was rolled out by BeyondTrust on Oct. 9, with the company calling on organisations running on-premises Remote Support installations to apply the update without delay. Three defensive postures were laid out by Mandiant and GTIG researchers, with the appropriate choice depending on an organisation's operational requirements, appetite for risk, and whether signs of intrusion had already surfaced: applying available patches; severing access routes to vulnerable appliances and rebuilding them from verified clean images; or deploying a set of compensating controls — among them tightening network-level restrictions, positioning a Web Application Firewall in front of edge devices, cycling through credentials, auditing and cancelling active sessions, trimming permission scopes, and moving credential storage into an external vault.
Findings published by Volexity on October 13 pointed to an unidentified attacker who had been exploiting a chain of zero-day vulnerabilities in Ivanti Connect Secure VPN devices running fully current software. The attack path chained together three separate vulnerabilities: a flaw that bypassed authentication controls, a mechanism allowing code to be run from outside the system, and a concluding step that granted the attacker higher-level access than the account originally held. Bundled under the identifier CVE-2026-104935, the two-part flaw — covering unauthorised access and the ability to run arbitrary code remotely — drew a CVSS rating of 8.6.
A flaw tracked as CVE-2026-76519, made public on Oct. 14, gave outside attackers the ability to push arbitrary files onto the underlying operating system of Cisco's Secure Email Gateway through its Advanced Malware Protection component. Assigned a CVSS score of 9.8, the flaw was placed on the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog on that same date. CVE-2026-0322, a flaw in Palo Alto Networks's PAN-OS that allows remote code execution and carries a CVSS rating of 8.6, joined the KEV catalog on that same date.
In a separate disclosure, GreyNoise detailed how a threat actor it designates "skynox7" has been assembling a residential proxy network by exploiting unpatched, internet-facing consumer devices — among them network-attached storage units and network video recorders. John Bambenek, president of Bambenek Consulting, noted that vulnerabilities of this kind in network devices or tools overseeing large portions of an organisation's IT infrastructure have been appearing at roughly a monthly pace, and that enterprises ought to collectively pressure vendors to treat device security with greater priority.
