# ARMORY CASTLE zero-days BeyondTrust Remote Support

Published: 2026-10-20 · Severity: severe · Sectors: Government (National), Technology
Canonical: https://vorant.io/reports/d6089952-b594-5dcd-8689-ad507ee616da/armory-castle-zero-days-beyondtrust-remote-support

> PRC-nexus actor ARMORY CASTLE exploited a zero-day in BeyondTrust Remote Support to upload arbitrary files; CVE now in CISA's KEV catalog.

CISecurity/MS-ISAC issued an advisory on CVE-2026-102764, a vulnerability in BeyondTrust Remote Support that stems from internal components failing to validate the origin of messages they receive, allowing arbitrary file upload operations on affected appliances. All self-hosted versions up to and including 26.2.3 are affected; BeyondTrust's SaaS offering has already been patched, but self-hosted deployments require manual patching.

Mandiant identified evidence that ARMORY CASTLE (formerly tracked as UNC5221), a suspected PRC-nexus espionage threat actor, exploited this flaw as a zero-day in late August 2026. Following successful exploitation, the actor used multiple TTPs to establish a foothold, escalate privileges, and move laterally within compromised environments. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, 2026, confirming active in-the-wild exploitation.

Defenders running self-hosted BeyondTrust Remote Support should apply the vendor patch immediately, verify SaaS instances are updated, and review logs for signs of unauthorized file operations, unexpected privilege escalation, or lateral movement originating from Remote Support appliances. Given confirmed exploitation by a sophisticated espionage actor against a widely-used remote access product, this should be treated as a high-priority patching action.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102764 (KEV)
- Threat actors: ARMORY CASTLE

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-beyondtrust-remote-support-could-allow-for-arbitrary-upload-of-files_2026-117

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d6089952-b594-5dcd-8689-ad507ee616da/armory-castle-zero-days-beyondtrust-remote-support.
In the app the same report carries live profiles of the CVEs and actors it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup