China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

The China-nexus cyber espionage group Armory Castle (formerly UNC5221 or Warp Panda) exploited a zero-day vulnerability in BeyondTrust Remote Support (formerly Bomgar) in late August 2026. The flaw, tracked as CVE-2026-102764 with a CVSS score of 9.3, involves improper origin validation in an internal messaging component. Exploitation of this vulnerability allowed attackers to take over remote support servers. The group has been previously tracked under multiple aliases, indicating a sophisticated and persistent threat actor. This incident highlights ongoing risks posed by China-linked espionage operations targeting enterprise remote support infrastructure. The high CVSS score underscores the critical severity of the vulnerability and the potential for widespread impact.