China-linked espionage group exploited BeyondTrust Remote Support zero-day

SecurityWeek reports that Mandiant and Google Threat Intelligence Group linked exploitation of BeyondTrust Remote Support flaw CVE-2026-102764 to Armory Castle, a China-linked espionage group. The report dates initial exploitation to August 29 and describes attackers deploying a webshell and deleting logs. BeyondTrust says it shipped a fix on October 8 and had patched all Remote Support SaaS customers by October 9; self-hosted customers without automatic updates should apply the fix manually.