China Nexus Threat Actor

Chinese hackers exploited zero-day in BeyondTrust Remote Support, company confirms

BeyondTrust disclosed that the China-linked group Mandiant tracks as Armory Castle exploited a critical zero-day vulnerability, CVE-2026-102764, in its Remote Support appliances starting August 29, 2026. The flaw, rated 9.3 CVSS, stemmed from an internal messaging component failing to validate message origin, letting attackers deploy a custom PHP webshell called SAWFLY within 11 minutes of exploitation.