WORLD WATCH · October 16, 2026 · NEWS
Chinese APT exploited BeyondTrust zero-day CVE-2026-102764
Armory Castle exploited CVE-2026-102764 in BeyondTrust for initial access.
- Reported by
- SecurityWeek
- Outlets reporting
- 1
- Category
- NEWS
- Identifiers
- CVE-2026-102764
- Newest report
- October 16, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Armory Castle exploited CVE-2026-102764 as a zero-day.
- Armory Castle deployed custom tools after initial access.
- Armory Castle deleted logs and artifacts.
- SecurityWeek reported the activity.
What happened
SecurityWeek reported that Armory Castle exploited CVE-2026-102764 as a zero-day. Armory Castle deployed custom tools after initial access. Armory Castle deleted logs and artifacts.
Why it matters
The activity shows a Chinese APT used a zero-day for initial access. The activity also shows post-exploitation tool deployment and log deletion.
What to do
- Review BeyondTrust systems for CVE-2026-102764 exposure.
- Hunt for custom tools and deleted logs.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 16, 2026). This brief summarizes reporting by SecurityWeek. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.