A privileged access management platform - the tool organizations deploy specifically to secure their most sensitive sessions - was itself the initial access vector for a Chinese APT group for two months. That is the lead story today. Alongside it, Palo Alto patches yet another actively exploited PAN-OS management interface flaw, and a BAE Systems breach demonstrates what happens when a single government contractor goes down.

In the News

Chinese APT Exploited BeyondTrust PAM Zero-Day Since August

Armory Castle (UNC5221), a Chinese state-sponsored threat actor, exploited CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support as a zero-day for approximately two months before it was discovered and patched. The vulnerability is an improper origin validation flaw in the platform’s internal messaging component, giving attackers a path to execute commands on the PAM appliance itself.

The implications are severe. BeyondTrust Remote Support is a privileged access management tool - it brokers and records sessions for administrators connecting to critical systems. Compromising the PAM platform gives an attacker visibility into every privileged session it manages, including credentials, session recordings, and connection targets. This is not a peripheral compromise; it is a direct strike at the highest-trust component in an identity architecture.

Armory Castle has a documented pattern of targeting edge devices and remote access infrastructure. Previous campaigns attributed to UNC5221 include exploitation of Ivanti Connect Secure VPN appliances (CVE-2023-46805/CVE-2024-21887) and Citrix ADC. The BeyondTrust compromise fits the same operational playbook: find the single appliance that brokers privileged access, exploit it before the vendor knows the flaw exists, and maintain persistence during the dwell window.

BeyondTrust shipped a patch on Thursday. Any organization running BeyondTrust Remote Support needs to patch immediately and conduct a forensic sweep for compromise indicators dating back to late August. Session logs, privileged credential stores, and downstream systems accessed through the platform should all be reviewed. MITRE ATT&CK: Initial Access (T1190), Credential Access (T1555).

What defenders should do: Patch BeyondTrust Remote Support immediately. Audit privileged session logs from August forward. Rotate any credentials that were brokered through the platform. Evaluate whether your PAM platform itself is monitored with the same rigor as the assets it protects.

PAN-OS Management Interface Zero-Day Exploited in the Wild

CVE-2026-0322 (CVSS 8.6) is an authenticated remote code execution vulnerability in the PAN-OS management interface, actively exploited in the wild. Palo Alto Networks shipped a patch on Wednesday. This is the second PAN-OS zero-day exploited this week, continuing a pattern of management-plane targeting against network security appliances.

The attack requires authenticated access to the management interface, which narrows the attack surface to environments where the management plane is reachable from compromised internal networks or, worse, exposed to the internet. Shodan and Censys scans consistently find thousands of PAN-OS management interfaces directly internet-facing - a configuration Palo Alto explicitly warns against in their hardening guides.

The operational lesson is unchanged from every prior NGFW management-plane vulnerability: management interfaces belong on isolated, out-of-band networks accessible only through hardened jump hosts with phishing-resistant MFA. Any other configuration converts a high-severity authenticated vulnerability into a trivially exploitable one. MITRE ATT&CK: Exploitation of Remote Services (T1210).

What defenders should do: Patch PAN-OS immediately. Verify that management interfaces are not internet-facing. Restrict access to out-of-band management networks with jump-host-only access and phishing-resistant MFA enforcement.

BAE Systems Breach Knocks Federal Bankruptcy Courts Offline

A cyberattack against BAE Systems has disrupted the Bankruptcy Noticing Center - the system responsible for sending legal notices for federal bankruptcy courts - nationwide since October 9. Court operations across the United States have been affected for over a week, with no public timeline for full restoration.

This is a textbook supply chain risk scenario. A single government contractor’s compromise cascaded into a nationwide disruption of a core judicial function. The attack vector has not been publicly disclosed, but the impact pattern - contractor compromise leading to government service outage - is exactly the scenario that third-party risk frameworks like NIST SP 800-161 are designed to address.

For organizations that rely on government contractors or serve as contractors themselves, this incident is a concrete example for vendor risk assessments. The question is not just “has the vendor passed a SOC 2 audit” but “what happens to our operations if this vendor goes down for a week or more?”

What defenders should do: Review third-party risk assessments for critical contractors. Evaluate operational resilience plans - not just security controls but continuity of operations when a contractor is offline. Ensure vendor agreements include incident notification timelines and recovery SLAs.

Collabora Online RCE Exploited to Backdoor Nextcloud Servers

CVE-2026-110447, a critical command execution flaw in the Collabora CODE Server app for Nextcloud, is being actively exploited to install backdoors on self-hosted file-sharing servers. Nextcloud is widely deployed in mid-market organizations and government agencies as a self-hosted alternative to commercial cloud file sync services.

Attackers are exploiting the flaw to establish web shells on compromised servers, providing persistent remote access. Organizations running Collabora Online through Nextcloud should patch immediately and audit their servers for unauthorized web shells, new user accounts, and unexpected outbound connections. MITRE ATT&CK: Exploitation of Public-Facing Application (T1190), Server Software Component: Web Shell (T1505.003).

What defenders should do: Patch Collabora CODE Server immediately. Scan Nextcloud servers for web shells in document processing directories. Review access logs for anomalous file operations and outbound connections from the server.

Defender Action Items

  • BeyondTrust Remote Support: Patch CVE-2026-102764 immediately. Conduct forensic review of privileged session logs from late August forward. Rotate all credentials brokered through the platform. Monitor downstream systems accessed via BeyondTrust for signs of lateral movement.
  • PAN-OS: Patch CVE-2026-0322 immediately. Audit management interface ACLs - interfaces must be restricted to out-of-band management networks with jump-host-only access. Run Shodan/Censys queries against your own address space to confirm no management interfaces are internet-facing.
  • Nextcloud/Collabora: Patch CVE-2026-110447. Audit servers for web shells (check Collabora document processing directories) and unauthorized accounts. Block known C2 indicators at the DNS layer.
  • Third-party risk: Use the BAE Systems incident as a catalyst to review contractor resilience plans. Identify single-contractor dependencies in critical operations and evaluate whether continuity plans account for week-plus outages.

Detection Spotlight

BeyondTrust Remote Support exploitation - look for anomalous internal messaging component activity and unexpected process execution from the BeyondTrust service context. The following Splunk SPL query identifies unusual child processes spawned by BeyondTrust service accounts, which may indicate post-exploitation command execution:

index=os sourcetype=sysmon EventCode=1
(ParentImage="*BeyondTrust*" OR ParentUser="beyondtrust_svc")
NOT (Image IN ("*bomgar-scc*", "*bomgar-pac*", "*BeyondTrust\\update*"))
| stats count by host, ParentImage, Image, CommandLine, _time
| where count < 3
| sort -_time

This query surfaces rare child processes spawned by BeyondTrust service binaries or service accounts. Low-frequency results in this context are high-fidelity indicators of post-exploitation activity - legitimate BeyondTrust operations produce a predictable set of child processes. Tune the NOT clause to match your deployment’s expected process tree. False positive rate is low in environments with a baselined BeyondTrust process inventory.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.