Threat actor
Armory Castle
Tracked by CyberSIXT since 24 Sep 2025 · last activity 16 Oct
- articles · all time
- 10+0 this week
- outlets
- 7
- week of 12 Oct · busiest week
- 7
- CVEs exploited · attributed
- 1
- CVEs also mentioned · not attributed
- 3
10 articles from 7 outlets since 24 Sep 2025; the latest 9 days ago.
- Article
- Research report
Show as table
Who reported 7 outlets, last 12 months
- Google Cloud1
- SecurityOnline1
- SOCRadar1
- The Hacker News1
- Dark Reading1
- Infosecurity1
- SecurityWeek1
CVEs exploited
1 CVE an article attributes to Armory CastleCVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability · attributed by GTIG, GTIG and Mandiant, Google, Mandiant, Mandiant and Google Threat Intelligence Group (GTIG), Mandiant and Google’s Threat Intelligence Group, 16 OctCVSS9.3CriticalExploited1.2%EPSS12articles
Also mentioned alongside Armory Castle (not attributed)
3 CVEs named in the same articlesShow 3 CVEs
CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVSS9.8CriticalExploited2.1%EPSS9articles
CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityCVSS8.6HighExploited1.7%EPSS6articles
CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCVSS8.6HighExploited87%EPSS15articles
- China-linked hackers exploited BeyondTrust zero-day to steal credentialsDark Reading
- BeyondTrust Patches Zero-Day Flaw Used to Gain Root AccessSOCRadar
- Chinese APT exploited BeyondTrust Remote Support flaw to steal filesSecurityWeek
- China-Linked Hackers Exploited BeyondTrust Flaw to Install Root BackdoorInfosecurity
- BeyondTrust Patches Remote Access Flaw Exploited to Steal CredentialsSecurityOnline
- China Linked Hackers Exploited BeyondTrust Zero Day to Steal CredentialsThe Hacker News
- China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero DayGoogle Cloud
- Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global EspionageSecurityOnline
- BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 DaysSecurityOnline
- UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology SectorsThe Hacker News · first in our coverage