[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAGU1gRthW5akqQsH2gCbDWDx27DxBLd1An8HFhuReZM":3},{"article":4,"iocs":51,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"dcd9f2ed-87be-4ed0-9eca-5ca677214677","Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning","critical-beyondtrust-vulnerability-faces-fresh-exploitation-probes-as-hackers-pr-da8f13","Fresh probes targeting CVE-2026-102764 have raised concerns that attacks against BeyondTrust Remote Support could spread beyond targeted espionage. Previdian reported two probes against decoy appliances in the United States and Europe, both from one source IP address geolocated to Hong Kong. The company said it had not observed successful exploitation from this activity, leaving wider […] The post Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning appeared first on Cyber Security News.","Fresh probes targeting BeyondTrust Remote Support vulnerability CVE-2026-102764 have emerged, raising concerns of wider exploitation beyond targeted espionage. While no successful exploitation has been confirmed from these recent probes originating from Hong Kong, previous exploitation of this critical flaw by suspected China-linked groups like ARMORY CASTLE has been documented, including zero-day attacks.","BeyondTrust Remote Support vulnerability CVE-2026-102764 sees fresh exploitation probes.","https:\u002F\u002Fcybersecuritynews.com\u002Fcritical-beyondtrust-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FCritical-BeyondTrust-Vulnerability-Faces-Fresh-Exploitation-Probes-as-Hackers-Prepare-for-Mass-Scanning.webp","2026-11-02T08:01:35+00:00","2026-11-02T09:00:26.388835+00:00",9,[17,20,23,25],{"name":18,"type":19},"BeyondTrust Remote Support","product",{"name":21,"type":22},"ARMORY CASTLE","threat_actor",{"name":24,"type":22},"UNC5221",{"name":26,"type":27},"BT26-05","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-102764","Critical vulnerability in BeyondTrust Remote Support",{"type":57,"value":58,"context":59},"malware","SAWFLY PHP web shell","Deployed in previous exploitation of the vulnerability",[18],{"controls":62,"vendors":146},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":93,"name":94,"problem":95,"products":96},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":122,"name":123,"problem":124,"products":125},"patch-management","Automated patch management","Known holes get closed in days, not months.",[126,130,138],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":122,"product_name":127,"url":128,"description":129},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"beyondtrust-rce-flaw-draws-mass-scanning-interest-after-state-linked-exploitation","BeyondTrust RCE Flaw Draws Mass Scanning Interest After State-Linked Exploitation","CVE-2026-102764, a critical vulnerability in BeyondTrust Remote Support, was initially weaponized as a zero-day by suspected China-linked threat actors before patches were available, demonstrating how high-value remote access tools are prime targets for nation-state espionage. The emergence of fresh scanning probes signals that opportunistic attackers are now preparing for broader exploitation, meaning the window for unpatched organizations to be compromised is narrowing rapidly. Remote support platforms are particularly dangerous targets because they inherently operate with elevated privileges and broad network access, amplifying the blast radius of any successful exploitation. This incident underscores that critical vulnerabilities in privileged access tools require emergency-tier patching response, not routine patch cycles.",[158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":166,"MITRE ATT&CK T1566: Phishing":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"OWASP A06:2021 Vulnerable and Outdated Components":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures, obligating operators to treat critical flaws in remote access tools as priority security incidents.","While scanning is the current threat vector, documented ARMORY CASTLE campaigns pair vulnerability exploitation with spearphishing for initial access, making end-to-end ATT&CK coverage—including T1190 (Exploit Public-Facing Application)—essential for detecting the full attack chain targeting BeyondTrust.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes, directly addressing the failure to patch a critical remote access vulnerability before wider exploitation commenced.","BeyondTrust Remote Support running a vulnerable version is a textbook instance of A06, where failure to track and update third-party software components exposes organizations to known, exploitable flaws.","Routine, prioritized vulnerability scanning and remediation workflows would have ensured the BeyondTrust patch was identified and applied before opportunistic mass scanning began.","This control mandates timely identification and remediation of technical vulnerabilities in systems, which would have driven an emergency response to CVE-2026-102764 in internet-facing remote support infrastructure.","BeyondTrust is a privileged remote access platform; hardening its authentication and access controls limits the damage an attacker can achieve even if the initial vulnerability is exploited."]