UNC5221 · Threat Recapactors/unc5221.htmlNews mentioning UNC5221Mon, 19 Oct 2026 12:28:44 GMT Prolific Chinese espionage group exploits BeyondTrust zero-dayhttps://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/bqhrqfFri, 16 Oct 2026 17:09:09 GMTCyberScoop. Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers.Zero-dayAPT ARMORY CASTLE Exploits BeyondTrusthttps://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/hn0p1gThu, 15 Oct 2026 14:00:00 GMTGoogle Threat Intelligence (+4 more sources). Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…ResearchVulnerabilityZero-dayAPTMalwareAdvisory