China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

A critical zero-day vulnerability (CVE-2026-102764, CVSS 9.3) in BeyondTrust Remote Support was exploited by the China-nexus threat actor Armory Castle to take over remote support servers before a patch was available. The flaw stemmed from improper origin validation in an internal messaging component — a fundamental input validation failure in a privileged, internet-facing tool. This matters significantly because remote support platforms inherently hold elevated access to endpoints across an organization, making them a high-value pivot point for espionage actors. Exploitation of zero-days in trusted security and IT management tools demonstrates that even defensive infrastructure can become an attacker's foothold if not properly isolated and monitored.