Chinese APT Group Exploited BeyondTrust Zero-Day for Initial Access

What Happened

A Chinese APT group known as Armory Castle exploited CVE-2026-102764, a zero-day vulnerability in BeyondTrust products, to gain initial access to target networks. After breaching systems, the attackers deployed custom tooling and systematically deleted logs and forensic artifacts to cover their tracks. This attack pattern shows sophisticated tradecraft focused on privileged access management systems, which are high-value targets because they control access to critical infrastructure.

Why SMBs Should Care

Privileged access management tools like BeyondTrust are designed to protect your most sensitive systems, but they also become single points of failure when compromised. For smaller organizations, the lesson here is twofold: first, ensure any PAM or remote access solutions are patched immediately when vendors release updates. Second, maintain independent logging and backup systems that attackers can't easily wipe. If your logs live only on the systems being attacked, you lose visibility when you need it most. Review your vendor security advisories regularly and have a plan to audit access logs after any suspicious activity.

Read the full SecurityWeek article

How O-Cyrus Can Help

O-Cyrus helps SMBs build resilient security architectures that include independent monitoring, log retention, and vendor risk management. If you're concerned about privileged access security or need help reviewing your current setup, contact our security team or visit o-cyrus.com to learn more about our infrastructure and security services.