Cybersecurity threats target BeyondTrust and Fortinet infrastructure

Cybersecurity researchers have identified two distinct high-impact exploitation campaigns targeting remote support and network security infrastructure.

A group identified as Armory Castle, linked to China-nexus cyber espionage, has exploited a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support. The flaw, which carries a CVSS score of 9.3, involves insufficient validation of message origins within an internal messaging component. This vulnerability allowed attackers to take control of self-hosted remote support appliances. BeyondTrust has released patches for SaaS versions and advises self-hosted users to perform manual updates.

Separately, Unit 42 researchers discovered PEERSTITCH, a memory-only implant targeting FortiGate firewalls. The malware was identified within a telecommunications service provider's environment. Attackers gained access via a vulnerability in FortiManager (CVE-2024-47575) to extract configurations and cryptographic material from over 500 managed firewalls. The attackers then utilized a second vulnerability (CVE-2025-61624) to achieve root access. While customer configurations were compromised, researchers noted that a direct breach of customer networks has not been confirmed.