Skip to content

CyberSIXT Search

Threat actor · coverage timeline

Armory Castle

10 articles from 7 outlets between 24 Sep 2025 and 16 Oct. First reported by The Hacker News. The busiest day was Fri 16 Oct, with 6 articles.

Articles: 10; all time · from 7 outlets
Days with coverage: 5; across 388 days
Busiest day: 6; articles on Fri 16 Oct
Last 7 days: 0a day; vs 0 a day before
First report: 24 Sep 2025; The Hacker News
CVEs named: 3; 3 in CISA KEV · in these articles

Coverage over time

10 articles · 24 Sep 2025 – 16 Oct

24 Sep 2025First report24 Sep 2025 · The Hacker News

Show as table

Armory Castle: articles per day
Day (UTC)	Articles	Outlets
Wed 24 Sep 2025	1	The Hacker News 1
Fri 26 Sep 2025	1	SecurityOnline 1
Thu 23 Oct 2025	1	SecurityOnline 1
Thu 15 Oct	1	Google Cloud 1
Fri 16 Oct	6	The Hacker News 1, SecurityOnline 1, Infosecurity 1, SecurityWeek 1, SOCRadar 1, Dark Reading 1

Articles

10 articles

Fri 16 Oct6 articles

20:58
China-linked hackers exploited BeyondTrust zero-day to steal credentialsDark Reading
14:25
BeyondTrust Patches Zero-Day Flaw Used to Gain Root AccessSOCRadar
10:59
Chinese APT exploited BeyondTrust Remote Support flaw to steal filesSecurityWeek
10:22
China-Linked Hackers Exploited BeyondTrust Flaw to Install Root BackdoorInfosecurity
09:08
BeyondTrust Patches Remote Access Flaw Exploited to Steal CredentialsSecurityOnline
07:56
China Linked Hackers Exploited BeyondTrust Zero Day to Steal CredentialsThe Hacker News

Thu 15 Oct1 article

21:49
China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero DayGoogle Cloud

Thu 23 Oct 2025 20251 article

02:46
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global EspionageSecurityOnline

Fri 26 Sep 2025 20251 article

01:30
BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 DaysSecurityOnline

Wed 24 Sep 2025 20251 article

15:26
UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology SectorsThe Hacker News · first report