What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
Google Threat Intelligence · Research ·
ARMORY CASTLE Exploits BeyondTrust
ARMORY CASTLE exploits BeyondTrust Remote Support vulnerability CVE-2026-102764.
Google Threat Intelligence reports that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor, exploited the vulnerability as a zero-day in late August 2026. The exploitation results in the arbitrary upload of files. Mandiant identified evidence of exploitation and observed the threat actor establish a foothold and escalate privileges. The vulnerability affects BeyondTrust Remote Support appliances.
Recommended by the publisher: Google Threat Intelligence recommends that affected organizations immediately apply the security patches provided by BeyondTrust to remediate the vulnerability.
Google Threat Intelligence reports a software supply chain compromise targeting AOMEI Technology.
The threat actor, attributed to UNC7017, conducted repeated short-burst configuration tampering against AOMEI's update infrastructure. The campaign delivered a multi-stage payload chain involving the CROSSROAD downloader and SHINYROAD backdoor. Impacted organizations spanned diverse sectors in multiple countries. The campaign was identified through collaborative research with the ManageEngine Threat Analysis Lab.
Recommended by the publisher: GTIG notified potentially affected organizations and shared technical findings with AOMEI Technology, which took corrective action to secure their distribution servers.