Google warns of actively exploited BeyondTrust vulnerability

CVE-2026-102764, affecting BeyondTrust Remote Support appliances, was exploited as a zero-day. Mandiant attributed the exploitation to the suspected PRC-nexus espionage threat actor ARMORY CASTLE, formerly tracked as UNC5221.