Google’s Threat Intelligence Group and Mandiant have warned organizations to prepare for potential widespread attacks following the public disclosure of a critical flaw in BeyondTrust Remote Support software. A suspected China-linked espionage group tracked as Armory Castle utilized the bug as a zero-day exploit starting in August to gain unauthorized access to target environments. The vulnerability allows unauthenticated attackers to execute arbitrary file operations, steal credentials, and escalate to root-level control over affected enterprise hosts. Threat actors deployed evasive malware such as the Sawfly web shell and Bareclaw tunneler to maintain persistence and obscure their network activity. BeyondTrust released security updates for self-hosted and cloud customers in October, with researchers strongly urging administrators to apply patches immediately to prevent opportunistic exploitation.

Full report : Google cybersecurity researchers reveal that a China-linked espionage group leveraged a critical remote support vulnerability to compromise enterprise systems, prompting urgent patching calls.