Chinese APT 'Armory Castle' Exploits BeyondTrust Zero-Day CVE-2026-102764

Chinese APT group Armory Castle exploited CVE-2026-102764, a zero-day in BeyondTrust, for initial access, deploying custom tools and deleting logs to evade detection. The vulnerability was exploited before a patch was available, indicating an active and sophisticated intrusion campaign. This highlights a critical supply-chain risk for organizations using BeyondTrust products.