Dell 0-Day Vulnerability Exploited by Chinese Hackers Since mid-2024 to Deploy Malware
A critical zero-day exploitation campaign has targeted Dell RecoverPoint for Virtual Machines. The vulnerability, identified as CVE-2026-22769, has a maximum CVSSv3.1 score of 10.0 and has been under active exploitation since at least mid-2024.
A critical zero-day exploitation campaign has targeted Dell RecoverPoint for Virtual Machines. The vulnerability, identified as CVE-2026-22769, has a maximum CVSSv3.1 score of 10.0 and has been under active exploitation since at least mid-2024.
Incident response efforts have linked this activity to UNC6201, suspected to have ties to a threat cluster known as Silk Typhoon (UNC5221). Mandiant and the Google Threat Intelligence Group (GTIG) have observed attackers exploiting this flaw to move laterally across networks, maintain persistent access, and deploy malware including SLAYSTYLE, BRICKSTORM, and a novel backdoor named GRIMBOLT.
The vulnerability arises from a configuration oversight in the Apache Tomcat Manager within Dell RecoverPoint appliances. Security researchers found hardcoded default credentials for the admin user in the /home/kos/tomcat9/tomcat-users.xml file. This flaw allows unauthenticated remote attackers to log into the Tomcat Manager, which is used for deploying software updates and management tasks. Attackers can then exploit the /manager/text/deploy endpoint to upload malicious WAR files.
In observed attacks, this method was used to deploy the SLAYSTYLE web shell, providing attackers with root-level command execution capabilities on the compromised appliance.
The threat actor has transitioned from using the BRICKSTORM backdoor to a new malware family called GRIMBOLT. First observed in September 2025, GRIMBOLT is written in C# and compiled using Native Ahead-of-Time (AOT) compilation, which converts the code into machine-native code during the build process. This approach removes Common Intermediate Language (CIL) metadata, complicating detection by security tools. The malware is also packed with UPX to further obfuscate static analysis.
UNC6201 ensures persistence by modifying the legitimate convert_hosts.sh script, enabling the backdoor to execute automatically at system boot via rc.local .
Beyond malware deployment, UNC6201 has utilized advanced networking tactics to navigate compromised environments stealthily. Mandiant analysts reported the creation of "Ghost NICs," temporary network interfaces configured on existing virtual machines within ESXi servers. These interfaces allow attackers to pivot between internal networks and Software-as-a-Service (SaaS) infrastructure undetected by standard network monitoring tools .
Additionally, the attackers employ Single Packet Authorization (SPA) using iptables . Forensic analysis revealed that attackers monitor incoming traffic on port 443 for a specific hexadecimal string. When detected, the source IP address is added to an allowlist, permitting connections to port 10443 while redirecting non-approved IP traffic.
CVE ID CVSS Score Description
CVE-2026-22769 10.0 (Critical) A hardcoded credential vulnerability in Dell RecoverPoint for Virtual Machines allows unauthenticated remote attackers to access the underlying OS and establish root-level persistence.
A critical zero-day exploitation campaign has targeted Dell RecoverPoint for Virtual Machines.
Dell has released urgent mitigation guidance for affected customers. The following versions require immediate attention:
Product Affected Versions Remediation Action
RecoverPoint for Virtual Machines 5.3 SP4 P1 Migrate to 6.0 SP3, then upgrade to 6.0.3.1 HF1 OR apply remediation script DSA-2026-079.
RecoverPoint for Virtual Machines 6.0 through 6.0 SP3 P1 Upgrade to 6.0.3.1 HF1 OR apply remediation script DSA-2026-079.
RecoverPoint for Virtual Machines 5.3 SP4 and earlier Upgrade to 5.3 SP4 P1 or a 6.x version, then apply the remediation script.
The following file and network indicators have been associated with this campaign.
Indicator Value Type Malware Family File Name / Context
24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c SHA256 GRIMBOLT support
dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591 SHA256 GRIMBOLT out_elf_2
92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a SHA256 SLAYSTYLE default_jsp.java
aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878 SHA256 BRICKSTORM NA
2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df SHA256 BRICKSTORM splisten
320a0b5d4900697e125cebb5ff03dee7368f8f087db1c1570b0b62f5a986d759 SHA256 BRICKSTORM NA
90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035 SHA256 BRICKSTORM NA
45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830 SHA256 BRICKSTORM NA
wss://149.248.11.71/rest/apisession C2 Endpoint GRIMBOLT NA
149.248.11.71 C2 IP GRIMBOLT NA
Based on reporting by Cyber Security News.