Chinese APT Group Leverages BeyondTrust Zero-Day Vulnerability

A Chinese Advanced Persistent Threat (APT) group, Armory Castle, has been observed exploiting a zero-day vulnerability (CVE-2026-102764) in BeyondTrust products. This exploitation was used for initial access, with attackers deploying custom tools and deleting logs to conceal their activities. This incident highlights ongoing cybersecurity threats from state-sponsored groups targeting critical software.