CISA Orders Federal Agencies to Patch Actively Exploited Dell RecoverPoint Flaw
Summary
CISA confirmed active exploitation of critical Dell RecoverPoint for Virtual Machines flaw CVE-2026-22769 and ordered federal agencies to patch by Saturday. Google and Mandiant attribute activity to UNC6201 and report BRICKSTORM and GRIMBOLT backdoors.
Key points
- Dell rated CVE-2026-22769 in RecoverPoint for Virtual Machines 10/10 severity and provided fixes.
- Google reported limited active exploitation; CISA confirmed exploitation and ordered federal agencies to patch by Saturday.
- Mandiant and Google attributed the activity to UNC6201, which they said has links to Silk Typhoon; targeting across North America was observed since at least mid-2024.
- Mandiant reported use of a newer BRICKSTORM backdoor and a novel backdoor it named GRIMBOLT, which appeared to replace BRICKSTORM.
- Researchers said it is unclear whether the switch to GRIMBOLT was planned or a response to incident-response efforts.
- The article notes that RecoverPoint appliances integrate with virtualization, storage, and backup systems and can operate with elevated privileges.
Article Details
- Severity
- Critical (10/10)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
CVE
People
Charles CarmakalMandiant's CTO discussed BRICKSTORM and GRIMBOLT use observed during exploitation and recommended applying Dell's fixes.Mayuresh DaniQualys security research manager Mayuresh Dani commented on the actor's understanding of VMware-based disaster recovery environments and the risks of compromising an appliance.Shane BarneyKeeper Security's Shane Barney explained the elevated privileges and operational impact of compromising Dell RecoverPoint for Virtual Machines.
Threat Actors
Silk TyphoonMandiant and Google said UNC6201 has links to Silk Typhoon. U.S. authorities accused Silk Typhoon of hacking the Treasury Department in 2024 and abusing vulnerabilities in Ivanti tools.UNC6201Mandiant and Google Threat Intelligence Group tied the exploitation of CVE-2026-22769 to UNC6201.
Malware
BRICKSTORMagencies have issued advisories and fixes, and CISA ordered immediate federal patching while researchers report use of BRICKSTORM and a newer backdoor called GRIMBOLT.GRIMBOLTagencies have issued advisories and fixes, and CISA ordered immediate federal patching while researchers report use of BRICKSTORM and a newer backdoor called GRIMBOLT.