ARMORY CASTLE BeyondTrust Zero-Day UK SMB Oct 2026 | SBCSG | The Small Business Cybersecurity Guy

This is your Daily Threat Analysis for the 16th of October 2026.

Three items today. One is a confirmed zero-day being exploited right now by a suspected Chinese state-linked actor. One is the most concrete example yet of AI being used to automate exploitation at scale. The third is a ransomware operation that has quietly restructured itself into something more dangerous than most organisations have accounted for. None of them are theoretical.

ARMORY CASTLE and the BeyondTrust Zero-Day: Why Your IT Provider’s Tools Are Your Problem

On the 15th of October 2026, BeyondTrust disclosed CVE-2026-102764, a vulnerability in its Remote Support appliances that allows arbitrary file upload. The advisory itself is relatively brief. What Mandiant published alongside it is not.

Mandiant has attributed active exploitation of this vulnerability to a threat actor they designate ARMORY CASTLE, assessed with moderate confidence as having a People’s Republic of China nexus. The actor exploited this as a zero-day in late August 2026, meaning it was being used against real targets approximately seven weeks before BeyondTrust disclosed it publicly.

What happened after initial access is the part that matters operationally. ARMORY CASTLE deployed a webshell designated SAWFLY and a tunneller designated BARECLAW. They then escalated privileges using SUID bit manipulation and harvested credentials from the compromised appliances. This is a textbook post-exploitation sequence: establish persistence, create a communications channel that blends with legitimate traffic, then move laterally using credentials rather than exploits.

The advisory attributes this to ARMORY CASTLE. What it does not say explicitly, though it is implied in the tooling, is that remote support appliances are particularly attractive targets precisely because of their legitimate network positioning. BeyondTrust Remote Support exists to give IT providers privileged access to their customers’ systems. Compromise one appliance and you potentially have a window into every organisation that appliance serves.

For UK SMBs, the practical question is not whether you run BeyondTrust yourself. The question is whether your managed IT provider does. Most smaller businesses do not control what remote access tooling their MSP uses. If your provider uses BeyondTrust Remote Support, CVE-2026-102764 is your exposure, not just theirs.

This is not a novel attack pattern. The same logic applies to any remote management platform. What is new here is a confirmed zero-day with active exploitation by a state-affiliated actor, and a short-but-specific post-exploitation chain that organisations can actually hunt for if they have the logging to do it.

What to do: Contact your IT provider today. Ask them directly whether they use BeyondTrust Remote Support and whether the patch for CVE-2026-102764 has been applied. Ask them to confirm when it was applied. If they cannot answer, that itself is information you need. If you manage your own IT: apply the patch, review recent remote access session logs for anomalous activity, and check for the presence of unexpected webshells or tunnelling software on your network perimeter.

Also worth noting: ARMORY CASTLE has previously exploited Ivanti vulnerabilities, CVE-2023-46805 and CVE-2024-21887 appear in the same threat intelligence cluster. If you have unpatched Ivanti Connect Secure appliances, today’s Ivanti zero-day report (CVE-2026-104935, a chain of three vulnerabilities enabling unauthenticated root access, first exploited on the 3rd of October 2026) compounds that exposure considerably.

AI-Orchestrated PaperCut Exploitation: Systematic, Scalable, and Documented

The second item is worth reading carefully because it represents a shift in how exploitation campaigns are being run, not just a new vulnerability.

Researchers at Hunt.io identified three exposed directories on attacker infrastructure that revealed an active campaign targeting PaperCut NG/MF print management software. The vulnerabilities being exploited are CVE-2026-81578 and CVE-2026-82078, exploited through a Tapestry vulnerability chain. The attacker also developed a second remote code execution path via XML-RPC abuse.

None of that is the significant part. The significant part is what was found in those exposed directories: AI agent instructions, exploit code, operational logs, and post-exploitation tooling. The logs document victims across 45 or more countries. This campaign is not being run by a person sitting at a terminal working through a target list. It is being run, substantially, by AI agents following structured instructions to identify, exploit, and post-exploit targets automatically.

ReliaQuest published a related report this week confirming the first documented incident in which large language model-driven AI agents executed substantial portions of an attack. In that case, the attackers exploited an exposed job-submission feature on an Apache Tomcat server running Spring Batch, no authentication required, no zero-days needed, using an open-source AI agent orchestration platform called Cairn. The entire sequence from initial access to significant compromise occurred within 24 hours.

What does this mean for UK SMBs? PaperCut is widely deployed in professional services firms, solicitors, accountancy practices, healthcare providers, and educational institutions. It manages print queues and document workflows, often with access to sensitive file systems. It is exactly the kind of application that gets installed, configured once, and then forgotten about until something breaks.

The NCSC has published guidance on patch management. The fact that PaperCut vulnerabilities continue to be exploited at scale, this is not the first major PaperCut exploitation campaign, tells you everything you need to know about how consistently that guidance is being followed.

The automation element changes the risk calculus. Traditional scanning and exploitation required human time and attention, which created a natural throttle on how many targets an attacker could work simultaneously. AI-orchestrated campaigns remove that throttle. If your PaperCut installation is vulnerable, the question is not whether someone will get around to exploiting it. The question is whether an automated system has already done so.

What to do: If you run PaperCut NG or MF, check your version against the patched releases for CVE-2026-81578 and CVE-2026-82078 immediately. Review your PaperCut server logs for anomalous access, unexpected script execution, or unusual outbound connections. If you use a managed print solution and do not know whether it runs PaperCut, find out today. The vendor can tell you in sixty seconds.

DragonForce: When a Ransomware Group Becomes a Cartel

DragonForce emerged in August 2023 using leaked LockBit 3.0 code. That is unremarkable, there were several groups doing the same thing in that period. What Bitsight’s profile documents is a more deliberate evolution.

By late 2024, DragonForce had transitioned to Conti v3-based ransomware variants. By March 2025, they had restructured their operation into what researchers describe as a cartel model: rather than simply running an affiliate programme where criminals pay to use their ransomware, DragonForce now offers white-label services. Other criminal groups can brand DragonForce ransomware as their own and use DragonForce infrastructure, management tools, and operational support. The parent organisation takes a cut. The affiliate takes 80 percent of ransom revenue.

This matters because it means the DragonForce threat surface is significantly larger than the group’s own direct operations. Any ransomware campaign using their infrastructure or code is effectively a DragonForce-adjacent incident, even if the group claiming responsibility has a different name.

The initial access vectors are not exotic. DragonForce affiliates exploit CVE-2021-44228 (Log4Shell, yes, still), CVE-2024-21412, CVE-2023-46805, CVE-2024-21887, CVE-2024-21893, and vulnerabilities in SimpleHelp remote monitoring software. These are known vulnerabilities with patches available. The organisations being hit by DragonForce affiliates are, in the main, organisations that did not patch.

For context: Log4Shell was disclosed in December 2021. We are in October 2026. If your environment still contains unpatched Log4j instances, you are nearly five years behind on a critical vulnerability that has been actively exploited throughout that entire period.

DragonForce’s sectoral targeting, based on available intelligence, spans professional services, manufacturing, retail, and healthcare, which maps almost precisely to the UK SMB sectors this briefing covers. That is not a coincidence. These sectors tend to have lower patching velocity, less mature security operations, and a higher proportion of legacy software.

What to do: Run a vulnerability scan against your internet-facing services and prioritise anything flagged against the CVEs listed above. If you do not have the capability to run that scan yourself, ask your IT provider to do it and send you the results. If Log4j is present in your environment in an unpatched state, treat it as a critical incident requiring immediate remediation, not a scheduled maintenance item.

On the Side: Supply Chain Exposure Through Edge Devices

One item from today’s intelligence that does not warrant a full section but is worth flagging: GreyNoise has documented a proxyjacking campaign, designated skynox7, that has compromised at least 143 network edge devices across 34 countries, forcing them into residential proxy networks. The devices targeted include D-Link ShareCenter NAS appliances, Ubiquiti UniFi Video NVR systems, and Hikvision and Dahua DVR/NVR devices.

The exploited vulnerabilities include CVE-2021-44228 (Log4Shell again), CVE-2024-3272, CVE-2024-3273, and CVE-2025-31324 in SAP NetWeaver Visual Composer.

The proxyjacking model is worth understanding. Compromised devices are used to route other criminal traffic, making malicious activity appear to originate from legitimate residential or business IP addresses. This degrades the effectiveness of IP-based blocking and attribution. It also means your router, NVR, or NAS device, if compromised, may be silently participating in campaigns against other organisations without any obvious indicator on your end.

Small businesses frequently deploy exactly these device categories, cheap NAS storage, CCTV systems using Hikvision or Dahua hardware, Ubiquiti networking, precisely because they are affordable and accessible. They also tend to sit at the network perimeter, receive infrequent firmware updates, and use default or weak credentials.

If you have any of these device categories on your network, check the manufacturer’s firmware update page today and ensure you are running current firmware. Change any default credentials if you have not already done so.

Summary

The three priority items for today:

BeyondTrust CVE-2026-102764, actively exploited zero-day by PRC-nexus actor ARMORY CASTLE. If your IT provider uses BeyondTrust Remote Support, verify patch status immediately and request confirmation of recent session audit.
PaperCut NG/MF CVE-2026-81578 and CVE-2026-82078, AI-orchestrated exploitation campaign confirmed across 45+ countries. If you run PaperCut, check your version and review logs. Do not assume you are too small to be a target; automated campaigns do not make that distinction.
DragonForce ransomware cartel, white-label model expands effective threat surface. Primary initial access vectors are unpatched known vulnerabilities including Log4Shell. Scan your internet-facing services.

If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically. And if you know someone who needs the heads-up, a fellow business owner, an office manager handling IT, a partner firm, pass it along. The information is only useful if it reaches the people who can act on it.

Sources

Source	Title	URL
Mandiant / Google Cloud	ARMORY CASTLE Exploits BeyondTrust	https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
Hunt.io	Inside a PaperCut Attacker’s AI Toolkit	https://hunt.io/blog/papercut-attacker-ai-toolkit-exploit-code-second-rce
Bitsight	DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel	https://www.bitsight.com/blog/threat-actor-profile-dragonforce-ransomware-group
GreyNoise	skynox7: Proxyjacking Edge Devices Into Residential Proxies	https://www.greynoise.io/blog/proxyjacking-edge-devices-residential-proxies
ReliaQuest	How AI Agents Turned One Exposed Endpoint into a Server Takeover	https://reliaquest.com/blog/threat-spotlight-how-ai-agents-turned-one-exposed-endpoint-into-a-server-takeover
op-c.net	Ivanti CVE-2026-104935: Zero-Day Chain Exploited in Operation Innovate	https://op-c.net/blog/ivanti-cve-2026-104935-zero-day-rce-exploit/