Threat actor
Armory Castle
China
Tracked by CyberSIXT since 24 Sep 2025
- Articles · all time
- 10
- Articles · last 30 days
- 7
- CVEs exploited · attributed · all time
- 1
- Research reports · all time
- 3
10 articles from 1 outlet since 24 Sep 2025; the latest 9 days ago.
- Article
- Research report
Show as table
Names and sources
- UTA0178
- Named by CyberSIXT coverage
- ARMORY CASTLE
- Named by Malpedia · uta0178
- Red Dev 61
- Named by Malpedia · uta0178
- UNC5221
- Named by Malpedia · uta0178
- UTA0178
- Named by Malpedia · uta0178
- ARMORY CASTLE
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
- Red Dev 61
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
- UNC5221
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
All 11 names
- UTA0178
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
- Armory Castle
- Named by CyberSIXT coverage
- f288f686-b5b3-4c86-9960-5f8fb18709a3
- Named by CyberSIXT coverage
Attributed facts
- origin
- China (MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3)
- Target country
- Germany (MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3)
CVEs exploited
1 CVE an article attributes to Armory CastleCVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability · attributed by Mandiant and Google Threat Intelligence Group (GTIG), Google, Mandiant, GTIG, Mandiant and Google’s Threat Intelligence Group, GTIG and Mandiant, 16 Oct · Source articleCVSS9.3CriticalExploited1.2%EPSS0articles
Vendors targeted
Malware and tools
Also mentioned alongside Armory Castle (not attributed)3 CVEs in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Armory Castle.
CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityCVSS8.6HighExploited1.7%EPSS0articles
CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCVSS8.6HighExploited87%EPSS0articles
CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVSS9.8CriticalExploited2.1%EPSS0articles
- China-linked hackers exploited BeyondTrust zero-day to steal credentialsDark Reading
- BeyondTrust Patches Zero-Day Flaw Used to Gain Root AccessSOCRadar
- Chinese APT exploited BeyondTrust Remote Support flaw to steal filesSecurityWeek
- China-Linked Hackers Exploited BeyondTrust Flaw to Install Root BackdoorInfosecurity
- BeyondTrust Patches Remote Access Flaw Exploited to Steal CredentialsSecurityOnline
- China Linked Hackers Exploited BeyondTrust Zero Day to Steal CredentialsThe Hacker News
- China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero DayGoogle Cloud
- Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global EspionageSecurityOnline
- BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 DaysSecurityOnline
- UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology SectorsThe Hacker News · first in our coverage