Chinese APT Armory Castle exploits BeyondTrust zero-day in first known attack

Researchers report the first known exploitation of a BeyondTrust zero-day by Chinese espionage group Armory Castle (UNC5221), occurring nearly seven weeks ago. The group, previously linked to Ivanti and Citrix compromises, continues a pattern of targeting perimeter devices. This signals an active, likely ongoing campaign against enterprise infrastructure.