Mandiant and Google Threat Intelligence disclosed CVE-2026-102764 on October 16, a critical authentication bypass in BeyondTrust Privileged Remote Access that a China-linked intrusion cluster tracked as ARMORY CASTLE exploited starting in August. The patch reached cloud customers automatically on October 8, six weeks before the public disclosure.
What ARMORY CASTLE did
ARMORY CASTLE gained root-level access to BeyondTrust Privileged Remote Access infrastructure through an unauthenticated API endpoint. PAM platforms are high-value targets because they hold credentials and session keys for every system the platform manages. Root access to the PAM host effectively means access to everything it manages.
Technical details
CVE-2026-102764 carries a CVSS score of 9.8. The flaw sits in BeyondTrust PRA's API authentication layer, where a crafted request bypasses credential verification entirely. Mandiant confirmed forensic evidence of exploitation beginning in early August, meaning attackers had undetected access for roughly ten weeks before the patch and six weeks before public disclosure.
Who is ARMORY CASTLE
ARMORY CASTLE is a China-nexus threat actor that Mandiant has tracked for several years targeting government agencies, defense contractors, and critical infrastructure. The group is known for patient, low-and-slow operations that prioritize persistence and intelligence collection over destructive payloads. The BeyondTrust campaign is consistent with that pattern.
What to do now
On-premises BeyondTrust PRA installations must patch to the latest version immediately. Cloud customers received the patch automatically on October 8 but should not assume they are clean. Key steps: rotate all credentials stored in or managed by the BeyondTrust platform; review session logs from August 1 onward for anomalous privileged sessions; hunt for lateral movement from hosts the PAM platform managed; confirm all outbound connections from the PAM host are authorized.
The broader lesson
PAM platforms are crown jewels. When they are compromised they become a force multiplier for the attacker. The six-week gap between vendor-side patching and public disclosure is not unusual for sensitive vulnerabilities, but it means defenders of on-premises deployments had no available patch during most of the exploitation window. This is an argument for aggressive patch management, threat hunting baselines on PAM infrastructure, and treating any PAM anomaly as a high-severity incident.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your organization needs incident response guidance or privileged access security review.