Prolific Chinese espionage group exploits BeyondTrust zero-day
A Chinese espionage group tracked as Armoury Castle, or UNC5221, exploited a zero-day vulnerability in BeyondTrust, with researchers identifying the first known attack occurring roughly seven weeks before disclosure. The group has previously compromised customers of Ivanti and Citrix.
Why this matters: BeyondTrust sells privileged access management tools. That means its customers use it to control who gets into their most sensitive systems. A Chinese espionage group getting inside that layer is not a routine breach. This same group already worked its way through Ivanti and Citrix customers. The pattern matters. Attackers are targeting the security and access infrastructure itself, which means the tools organizations trust to protect everything else are the ones being turned against them.
Who should care: Cybersecurity · Privacy officers · Administrators
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.