4 casos · pág. 1/1
On 24 September 2026, GreyNoise observed a malicious actor using 149.104.78.141 to attempt pre-disclosure zero-day exploitation of a Citrix NetScaler Gateway on a Project Swarm participant sensor. No CVE-specific detections existed at the time, but behavioral detections labeled the activity malicious within seconds. The attempt failed to …
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
Cloudflare published defensive guidance following the disclosure of actively exploited Citrix NetScaler vulnerabilities. CVE-2026-88771 allows unauthenticated command execution on affected appliances, including in the default configuration. CVE-2026-88772 affects configurations using DTLS. Citrix's September 27, 2026 bulletin reported obs…
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
