UNC6201 Used Dell RecoverPoint Zero-Day Since Mid-2024, Researchers Say
Summary
Mandiant and Google Threat Intelligence Group say suspected China-backed UNC6201 exploited a hardcoded-credential flaw in Dell RecoverPoint for Virtual Machines since mid-2024, deploying Grimbolt and using Ghost NICs to move through VMware environments.
Key points
- Mandiant and Google Threat Intelligence Group attribute exploitation since mid-2024 of CVE-2026-22769 to suspected China-backed group UNC6201.
- Dell says the hardcoded-credential flaw affects RecoverPoint for Virtual Machines versions before 6.0.3.1 HF1 and could enable unauthenticated remote access and root-level persistence.
- Researchers say UNC6201 deployed Grimbolt, a newly identified C# backdoor, and observed the group replacing Brickstorm with it in September 2025; the reason for the switch is unclear.
- UNC6201 used temporary virtual network ports, called Ghost NICs, on VMware ESXi to pivot from compromised virtual machines into internal or SaaS environments.
- Mandiant says Ghost NICs are a technique it had not previously observed in its investigations; the group also targets appliances that often lack traditional EDR agents.
- Dell advises customers to upgrade or apply its stated remediations to address the ongoing exploitation.
Article Details
- Event Type
- Zero-day exploitation of a hardcoded-credential vulnerability in Dell RecoverPoint for Virtual Machines, with deployment of backdoor malware and stealthy movement through virtualized infrastructure.
- Impact
- The vulnerability can allow an unauthenticated remote attacker who knows the hardcoded credential to access the underlying operating system and establish root-level persistence. Researchers report that UNC6201 exploited it since mid-2024, deploying Grimbolt and using temporary virtual network ports to move through victim networks. The article reports no quantified impact.
CVE
People
Threat Actors
ARMORY CASTLESeparate Chinese threat cluster reported to exploit Ivanti zero-days and target government agencies; researchers found overlaps with UNC6201. GTIG does not consider the two clusters identical.Silk TyphoonChinese state-backed threat group to which UNC5221 has previously been linked; the article says GTIG does not consider UNC5221 and Silk Typhoon identical.UNC6201Suspected Chinese state-backed group reported to have exploited CVE-2026-22769 in Dell RecoverPoint for Virtual Machines since mid-2024, deployed Grimbolt, and used Ghost NICs to move through victim networks.
Malware
BRICKSTORMThe intruders deployed a new C# backdoor called Grimbolt (replacing Brickstorm) and used stealthy Ghost NICs on VMware ESXi to move laterally; Dell urges immediate remediation.GRIMBOLTThe intruders deployed a new C# backdoor called Grimbolt (replacing Brickstorm) and used stealthy Ghost NICs on VMware ESXi to move laterally; Dell urges immediate remediation.Spawnantthreat cluster, UNC5221, known for exploiting Ivanti zero-days to target government agencies with custom Spawnant and Zipline malware and previously linked to the notorious Silk Typhoon Chinese state-backed threatZiplineUNC5221, known for exploiting Ivanti zero-days to target government agencies with custom Spawnant and Zipline malware and previously linked to the notorious Silk Typhoon Chinese state-backed threat group (although
Vendors
Dellstate-backed group, UNC6201, has been exploiting a hardcoded-credential zero-day (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since mid-2024 to gain unauthenticated access and root persistence.VMwareThe intruders deployed a new C# backdoor called Grimbolt (replacing Brickstorm) and used stealthy Ghost NICs on VMware ESXi to move laterally; Dell urges immediate remediation.
Products
Dell RecoverPoint for Virtual Machinesgroup, UNC6201, has been exploiting a hardcoded-credential zero-day (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since mid-2024 to gain unauthenticated access and root persistence.VMware ESXiThe intruders deployed a new C# backdoor called Grimbolt (replacing Brickstorm) and used stealthy Ghost NICs on VMware ESXi to move laterally; Dell urges immediate remediation.VMware vCenterthe legal and technology sectors, while CrowdStrike has linked Brickstorm malware attacks targeting VMware vCenter servers of legal, technology, and manufacturing companies in the United States to a Chinese hacking
Countries
Industries
GovernmentUNC6201 and a separate Chinese threat cluster, UNC5221, known for exploiting Ivanti zero-days to target government agencies with custom Spawnant and Zipline malware and previously linked to the notorious Silk TyphoonLegalorganizations in the legal and technology sectors, while CrowdStrike has linked Brickstorm malware attacks targeting VMware vCenter servers of legal, technology, and manufacturing companies in the United States to aManufacturinghas linked Brickstorm malware attacks targeting VMware vCenter servers of legal, technology, and manufacturing companies in the United States to a Chinese hacking group it tracks as Warp Panda.Technologyorganizations in the legal and technology sectors, while CrowdStrike has linked Brickstorm malware attacks targeting VMware vCenter servers of legal, technology, and manufacturing companies in the United States to a