Analysis
Google Threat Intelligence Group and Mandiant report that attackers exploited CVE-2026-102764, a file-upload flaw in BeyondTrust Remote Support, as a zero-day. Their observations include post-exploitation persistence and log deletion, making the history of access relevant to any assessment of a previously compromised host.
The researchers attribute the activity to ARMORY CASTLE, which they assess to be a suspected PRC-linked actor. That attribution is their assessment. For defenders considering the report, the observed behavior provides a reason to examine whether earlier access left changes that require attention beyond the vulnerable entry point.
Closing the original entry point does not establish that a previously compromised host is clean. Persistence could allow access to survive closure of the original route. Addressing that entry point therefore answers a narrower question than investigating what an intruder did and what remains.
Investigation should follow vendor guidance and use retained evidence. Reported log deletion complicates interpretation: a missing record cannot establish that no activity occurred. The response should assess exposure and examine evidence of earlier access, with conclusions tied to what investigators can support. The report does not establish that every installation was compromised.
Source: Primary source · 2026-10-15 · Primary source context · attributed account