China-Linked Hackers Exploit BeyondTrust Zero-Day to Compromise Remote Support Servers

This report reveals that a hacking group linked to China, known as Armory Castle, exploited a zero-day vulnerability in BeyondTrust Remote Support software on a self-hosted appliance. The attackers deployed the SAWFLY web shell to take control of remote support servers, highlighting ongoing cybersecurity threats to enterprise infrastructure.

Originally published by gnews