On 29 August, somebody walked into the software that IT help desks use to take over your computer and fix it. They got root on the box, emptied its password vault, made themselves an administrator, and quietly logged into the machines it could reach. The company that makes the software didn't find out for a month.
Glyph · Saturday 17 October 2026
Read next
Sources
- ARMORY CASTLE and BT26-05: What Security Teams Need to Know (updated 16 Oct 2026, 12:00pm EDT)
- Security advisory BT26-05 (CVE-2026-102764)
- ARMORY CASTLE Exploits BeyondTrust
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
- Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
- Active Exploitation of BeyondTrust Remote Support Vulnerability (CVE-2026-102764), CC-4870
- BeyondTrust security advisory (AV26-1054) - Update 1
- CVE-2026-102764: BeyondTrust Zero-Day Exploited
- Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
- Chinese Hackers Lurked Nearly 400 Days in Networks With Stealthy BrickStorm Malware
- CISA, NSA and Cyber Centre Warn Critical Infrastructure of BRICKSTORM Malware
- BRICKSTORM Backdoor (AR25-338A)
- Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary
- Treasury letter to Congress on December 2024 cyberattack
- Security advisory BT24-10 (CVE-2024-12356)
- US Treasury Department breached through remote support platform
- Treasury Department hacked: Explaining how it happened
- Alerts and advisories
This desk has not corrected this file. Corrections.
The paper
Comments
No notes on this story yet.
Sign in to comment