Prolific Chinese espionage group exploits BeyondTrust zero-day

The Armory Castle (UNC5221) threat group, linked to Chinese state-sponsored espionage, exploited a zero-day vulnerability in BeyondTrust's Remote Support product — a privileged access tool trusted by organizations to manage sensitive systems. This attack follows a clear pattern of targeting widely-deployed security and remote access products, making these tools high-value entry points for nation-state actors. Zero-day exploitation means defenders had no prior patch available, making pre-disclosure threat hunting and compensating controls essential. The incident highlights that security tooling itself is a critical attack surface and must be subject to the same rigorous monitoring and segmentation as any other high-risk asset. Organizations relying on internet-facing privileged access solutions without robust anomaly detection and segmentation are especially exposed.