Threat actor
Armory Castle
China
Tracked by CyberSIXT since 24 Sep 2025
- Articles · all time
- 10
- Articles · last 30 days
- 7
- CVEs exploited · attributed
- 1
- Research reports · all time
- 3
10 articles from 1 outlet since 24 Sep 2025; the latest 9 days ago.
- Article
- Research report
Show as table
Names and sources
- UTA0178
- Named by CyberSIXT coverage
- ARMORY CASTLE
- Named by Malpedia · uta0178
- Red Dev 61
- Named by Malpedia · uta0178
- UNC5221
- Named by Malpedia · uta0178
- UTA0178
- Named by Malpedia · uta0178
- ARMORY CASTLE
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
- Red Dev 61
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
- UNC5221
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
All 11 names
- UTA0178
- Named by MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3
- Armory Castle
- Named by CyberSIXT coverage
- f288f686-b5b3-4c86-9960-5f8fb18709a3
- Named by CyberSIXT coverage
Attributed facts
- origin
- China (MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3)
- Target country
- Germany (MISP Galaxy · f288f686-b5b3-4c86-9960-5f8fb18709a3)
CVEs exploited
1 CVE an article attributes to Armory CastleCVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability · attributed by Mandiant and Google Threat Intelligence Group (GTIG), Google, Mandiant, GTIG, Mandiant and Google’s Threat Intelligence Group, GTIG and Mandiant, 16 Oct · Source articleCVSS9.3CriticalExploited1.2%EPSS0articles
Also mentioned alongside Armory Castle (not attributed)
3 CVEs named in the same articlesShow 3 CVEs
CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityCVSS8.6HighExploited1.7%EPSS0articles
CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCVSS8.6HighExploited87%EPSS0articles
CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCVSS9.8CriticalExploited2.1%EPSS0articles
Vendors targeted
Malware and tools
- China-linked hackers exploited BeyondTrust zero-day to steal credentialsDark Reading
- BeyondTrust Patches Zero-Day Flaw Used to Gain Root AccessSOCRadar
- Chinese APT exploited BeyondTrust Remote Support flaw to steal filesSecurityWeek
- China-Linked Hackers Exploited BeyondTrust Flaw to Install Root BackdoorInfosecurity
- BeyondTrust Patches Remote Access Flaw Exploited to Steal CredentialsSecurityOnline
- China Linked Hackers Exploited BeyondTrust Zero Day to Steal CredentialsThe Hacker News
- China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero DayGoogle Cloud
- Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global EspionageSecurityOnline
- BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 DaysSecurityOnline
- UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology SectorsThe Hacker News · first in our coverage