Armory Castle
Unknown Active
- Mentions
- 3
- First seen
- 16 Oct 2026
- Last seen
- 16 Oct 2026
Relevant to you · Affects your stack
- Technology:
- Microsoft Remote Desktop Gateway
- Threat focus:
- espionage / apt
- Sector / region:
- Manufacturing
Origin
Unattributed
Profile
Armory Castle is a threat actor linked in recent reporting to the exploitation of a zero-day vulnerability in BeyondTrust Remote Support. Reports indicate Chinese APT or China-linked hackers exploited the vulnerability to take over remote support servers. The incidents continue the trend of exploited edge vulnerabilities.
Affected vendors
BeyondTrustIvantiCiscoPalo Alto Networks
Linked CVEs
- CVE-2026-102764 CVSS 9.3 EPSS 0%