Skip to content
Threat Feed
Subscribe

Actor

ARMORY CASTLE

1 brief RSS
critical threat

ARMORY CASTLE Exploitation of BeyondTrust Remote Support

The PRC-nexus actor ARMORY CASTLE is exploiting the arbitrary file upload vulnerability CVE-2026-102764 in BeyondTrust Remote Support appliances to deploy web shells, escalate privileges, and harvest credentials.

exploited Remote Support ARMORY CASTLE espionage webshell cve-2026-102764 beyondtrust
2r 3t 1c