Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
BLUF
Organizations using BeyondTrust products should urgently hunt for compromise and apply vendor mitigations because an active Chinese APT campaign is exploiting CVE-2026-102764 as a zero-day.
NEWS
SecurityWeek reported that Armory Castle used CVE-2026-102764 in BeyondTrust software to obtain initial access. The group deployed custom tools and deleted logs and artifacts to hinder detection and forensic analysis. The activity was attributed to a Chinese advanced persistent threat actor.
Why I Care
BeyondTrust products are commonly used for privileged remote access, so exploitation can expose credentials, administrative sessions, and sensitive networks. Because the attackers destroy logs and artifacts, breaches may remain hidden longer and cause greater operational or data compromise.
Next Steps
Security teams should immediately inventory all BeyondTrust deployments, apply vendor patches or mitigations as soon as available, hunt for Armory Castle indicators and anomalous privileged access, isolate suspected systems, rotate credentials and keys tied to affected platforms, enable MFA where possible, and preserve any remaining logs or memory artifacts for incident response.
Source: Security Week ·