Google’s cybersecurity team announced on October 15 that a suspected spy hacker organization, possibly associated with the Chinese Communist Party (CCP), launched attacks in August using undisclosed vulnerabilities in the products of the American cybersecurity company BeyondTrust.
The Google Threat Intelligence Group (GTIG) and its cybersecurity firm Mandiant released a report on the same day attributing the attacks to the suspected spy organization “Armory Castle” (formerly known as UNC5221), allegedly linked to the CCP. The report stated that the organization breached BeyondTrust’s remote support equipment in late August using a “zero-day vulnerability,” referring to security flaws that the vendor has not discovered or patched.
The product in question, Remote Support, is used by enterprise IT personnel to remotely troubleshoot computer issues. Mandiant revealed that after infiltrating, the attackers gained the highest system privileges, attempted to extract stored passwords, accessed internal computers through remote support features, downloaded internal files, and repeatedly deleted logs to evade detection.
The report warned that this vulnerability is now public, and companies should “prepare for potential large-scale exploitation.” Mandiant explained that the organization has previously covertly targeted specific entities using zero-day vulnerabilities, then exploited them on a larger scale when institutions had not yet patched them.
GTIG stated that Armory Castle has been active at least since October 2023, targeting entities across various countries and industries, and previously exploiting vulnerabilities in networking devices such as Citrix and Ivanti. With a high degree of confidence, GTIG assessed that the organization will continue exploiting zero-day vulnerabilities in edge network devices to support its espionage activities.
BeyondTrust confirmed that there were two instances of breaches on August 29 and released a patch in early October to address the vulnerabilities.
Overall, the security landscape remains dynamic and requires constant vigilance and rapid responses to evolving threats to safeguard critical systems and data.