Team Cymru Links Three IPs to Likely GRIMBOLT C2 Cluster via X.509 Certificate
Summary
Team Cymru used Scout telemetry to link three IPs to a likely GRIMBOLT C2 cluster via an identical X.509 certificate, shared ASN and port profiles. It says external telemetry limits certainty; the servers were reported to the VPS provider.
Key points
- Team Cymru began with an IP Google had identified as a GRIMBOLT command-and-control server linked to UNC6201.
- A shared X.509 certificate, including the same NetBIOS common name and certificate hash, connected two additional IPs to the initial address.
- The three IPs also shared an ASN and overlapping open-port profiles, which Team Cymru says supports the assessment that they are likely part of one infrastructure cluster.
- The researchers describe using WHOIS, passive DNS, port banners, certificate data and NetFlow to profile infrastructure and find related systems.
- The absence of observed sslip[.]io DNS records on the two additional IPs may reflect telemetry visibility gaps or a deliberate operational choice.
- Team Cymru assesses the links with medium-to-high confidence but notes that external telemetry cannot verify server internals or prove the presence of GRIMBOLT; it reported the IPs to the VPS provider.
- The article recommends adding the IPs to alerting or block lists, retrospectively hunting for connections, and monitoring for connections to organizational networks.
Article Details
- Attack Vectors
- Google reported that the UNC6201 campaign exploited the critical zero-day CVE-2026-22769 in Dell RecoverPoint for Virtual Machines.
- Google observed UNC6201-linked operators replacing older BRICKSTORM binaries with GRIMBOLT.
- Team Cymru assessed that three IP addresses likely formed a GRIMBOLT infrastructure cluster, based on a matching X509 certificate, ASN, and open-port profiles.
- Defensive Notes
- Add the known UNC6201 C2 IP and the two additional assessed cluster IPs to alerting or block lists.
- Retrospectively search for historical connections to the three IP addresses.
- Monitor the IPs for connections to perimeter or supply-chain networks.
- Schedule Scout API queries for IPs presenting the identified X509 certificate.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 140[.]82[.]18[.]134 | Team Cymru assessed with medium-to-high confidence that this IP belongs to the same GRIMBOLT infrastructure cluster as the known C2 server. |
| IPV4 | 149[.]248[.]11[.]71 | Google identified this IP as a GRIMBOLT C2 server; Team Cymru used it as the starting point for its infrastructure pivot. |
| IPV4 | 66[.]42[.]111[.]219 | Team Cymru assessed with medium-to-high confidence that this IP belongs to the same GRIMBOLT infrastructure cluster as the known C2 server. |
| SHA256 | 8521f42ce73b1646ccf6d85d876e40662fd0560aeded05ce62b94e5e30233cbe | X509 certificate fingerprint shared by the three IPs assessed as likely GRIMBOLT infrastructure. |
MITRE ATT&CK
CVE
Threat Actors
ARMORY CASTLEGoogle reported notable overlap with UNC6201 but does not currently consider the two clusters to be the same; Microsoft has used this name synonymously with Silk Typhoon, formerly HAFNIUM.HafniumThe article identifies HAFNIUM as the former name associated with Silk Typhoon, which Microsoft has used synonymously with UNC5221.Silk TyphoonMicrosoft has used Silk Typhoon synonymously with UNC5221; the article notes that Google does not consider UNC5221 and UNC6201 to be the same cluster.UNC6201Google described UNC6201 as a suspected PRC-nexus threat cluster involved in a campaign exploiting Dell RecoverPoint for Virtual Machines and deploying GRIMBOLT; attribution is reported, not forensically proven.