How the Chinese espionage group Armory Castle used a zero-day in BeyondTrust Remote Support to quietly gain root, steal credentials and dig in — and why Ivanti, Cisco and Palo Alto were all under fire at the same time this week.