China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

China-linked hackers, known as Armory Castle, exploited a zero-day vulnerability in BeyondTrust Remote Support in late August 2026. The vulnerability is related to improper origin validation in an internal messaging component. It has been assigned the identifier CVE-2026-102764 and has a CVSS score of 9.3, indicating a high level of severity. The exploitation of this flaw allowed the hackers to take control of remote support servers. The group Armory Castle is also known by other names, including UNC5221 and Warp Panda. The vulnerability was exploited before it was publicly disclosed.