dated primary evidence

BeyondTrust and Google disclose ARMORY CASTLE zero-day exploitation and remediation

Oct15 Google Threat Intelligence/Mandiant and BeyondTrust disclosed observed exploitation of CVE-2026-102764 in BeyondTrust Remote Support associated by Google with actor ARMORY CASTLE. Exploitation traces predate disclosure (late August), SaaS patches were applied by Oct9 according to vendor. Actor suspected PRC nexus is intelligence analysis, not demonstrated state tasking; no AI infrastructure-specific victims established. Disclosure is not attack onset or proof Chinese state involvement.