Suspected China-Linked Group Exploited Critical BeyondTrust Flaw Before Disclosure, Google Warns

Google has warned that a suspected China state-sponsored actor, tracked as Armory Castle, exploited a critical vulnerability in BeyondTrust Remote Support (CVE-2026-102764, CVSS 9.3). The activity was seen in August 2026. BeyondTrust released a patch on October 8 for both SaaS and self-hosted customers, and publicly disclosed the flaw on October 15. The vendor is withholding technical details while appliances are still being patched.

According to Google, the attackers escalated their privileges and established persistent access on compromised appliances. They deployed a lightweight, obfuscated web shell called Sawfly, which uses encrypted two-way communication to receive instructions. Google said the follow-on tactics were designed to maintain access and move laterally, and were tailored for BeyondTrust systems.

Armory Castle has been active since October 2023 and is known for long-term intelligence collection for the People's Republic of China. Its documented targets include legal services, SaaS providers, business-process outsourcers, technology companies and government. Google believes the group will keep using zero-day flaws in edge devices to gain access. It also cautioned that organisations should prepare for widespread exploitation now that the flaw is public, as this group and others have historically launched broad, opportunistic attacks after disclosure. Google urged affected customers to apply patches immediately.