UNC6201 Exploits Dell RecoverPoint Zero-Day to Deploy GRIMBOLT
Summary
Mandiant and Google GTIG report that suspected PRC-nexus cluster UNC6201 has exploited CVE-2026-22769 in Dell RecoverPoint for Virtual Machines since at least mid-2024, using Ghost NICs and stealthy persistence and adding GRIMBOLT in 2025.
Key points
- Mandiant and Google GTIG report that UNC6201 has exploited CVE-2026-22769, a CVSS 10.0 flaw in Dell RecoverPoint for Virtual Machines, since at least mid-2024.
- The suspected PRC-nexus cluster used SLAYSTYLE, BRICKSTORM and other tools after gaining access through the vulnerability.
- Researchers say UNC6201 began replacing BRICKSTORM binaries with GRIMBOLT in September 2025; the C# backdoor uses ahead-of-time compilation, which the article says complicates static analysis.
- On compromised ESXi servers, the group created temporary network ports called “Ghost NICs” to pivot into internal networks and SaaS infrastructure.
- The attackers reportedly used SLAYSTYLE and iptables proxying for persistence, with a Single Packet Authorization “knock” that opened a port for 300 seconds.
Article Details
- Event Type
- A suspected PRC-nexus cluster, UNC6201, reportedly exploited a zero-day vulnerability in Dell RecoverPoint for Virtual Machines to gain access and deploy backdoors.
- Impact
- The reported activity provided footholds in the virtualization layer of affected organizations. UNC6201 used compromised ESXi servers to pivot into internal networks and SaaS infrastructure, and used stealthy persistence techniques, including a packet-triggered port that opened for 300 seconds.
MITRE ATT&CK
T1090 · ProxyThe article reports that UNC6201 used iptables proxying to redirect subsequent traffic after the initial approved traffic.T1205.001 · Port KnockingThe reported Single Packet Authorization mechanism used a packet with a unique HEX string as a secret knock to open a port for 300 seconds.T1505.003 · Web ShellThe article reports that UNC6201 deployed the SLAYSTYLE web shell for persistence.
CVE
Threat Actors
Malware
BRICKSTORMUNC6201 has been exploiting the flaw since at least mid-2024 to deploy SLAYSTYLE, BRICKSTORM, and other tools.GRIMBOLTreport UNC6201 upgraded its toolkit in September 2025 to include an AOT-compiled C# backdoor named GRIMBOLT and used techniques like Ghost NICs and an iptables-based Single Packet Authorization for stealthySLAYSTYLEUNC6201 has been exploiting the flaw since at least mid-2024 to deploy SLAYSTYLE, BRICKSTORM, and other tools.
Vendors
Products
Dell RecoverPoint for Virtual MachinesA high-risk zero-day vulnerability in Dell RecoverPoint for Virtual Machines (CVE-2026-22769) has been exploited since mid-2024 by a suspected PRC-nexus cluster tracked as UNC6201 to gain footholds in the virtualizationESXiAttackers created temporary “Ghost NICs” on compromised ESXi servers to pivot to internal networks and SaaS infrastructure.