ARMORY CASTLE exploited BeyondTrust flaw as a zero-day

Mandiant found evidence that ARMORY CASTLE exploited a BeyondTrust remote-support appliance flaw as a zero-day in late August; the flaw was disclosed October 15. Reported activity included root access, credential-vault targeting, durable startup persistence, and log deletion, making patching and targeted artifact hunting urgent.