Chinese Hackers Exploit BeyondTrust Zero-Day

Suspected Chinese group Armory Castle exploited BeyondTrust zero-day CVE-2026-102764 on August 29. The flaw, with a CVSS score of 9.3, affects Remote Support versions up to 26.2.3. BeyondTrust released a patch on October 8 after Mandiant tipped them off. Attackers used custom malware called Sawfly and Bareclaw. Group has been active since October 2023.