# UNC6201 Exploits Dell RecoverPoint Zero-Day CVE-2026-22769

> Mandiant and GTIG detail UNC6201's exploitation of CVE-2026-22769 in Dell RecoverPoint for VMs, deploying GRIMBOLT backdoor and novel VMware TTPs.

- Published: 2026-02-25T04:45:26.000Z
- Severity: high
- Category: Threat Intel
- Tags: UNC6201, CVE-2026-22769, Dell RecoverPoint, GRIMBOLT, BRICKSTORM, SLAYSTYLE, PRC Nexus, Zero-Day, VMware, APT
- Author: Runtime Rebel Intel
- Primary source: https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day/
- Canonical: https://runtimerebel.com/blog/unc6201-exploits-dell-recoverpoint-zero-day-cve-2026-22769

## Overview

Mandiant and Google Threat Intelligence Group (GTIG) have identified active zero-day exploitation of a critical vulnerability, CVE-2026-22769, in Dell RecoverPoint for Virtual Machines. This flaw carries a CVSSv3.1 score of 10.0, indicating maximum severity. The suspected PRC-nexus threat cluster, UNC6201, has been exploiting this vulnerability since at least mid-2024 to achieve lateral movement, maintain persistent access, and deploy various malware, including SLAYSTYLE, BRICKSTORM, and a newly identified backdoor dubbed GRIMBOLT. While the initial access vector remains unconfirmed, UNC6201 is known for targeting edge appliances such as VPN concentrators for initial compromise, according to [Google Threat Intelligence Group](https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day/).

Dell has released remediations for CVE-2026-22769, and customers are strongly urged to apply the guidance provided in the official Dell Security Advisory to protect against these ongoing threats.

## Technical Analysis

### CVE-2026-22769 Exploitation Details

Mandiant discovered CVE-2026-22769 during investigations into compromised Dell RecoverPoint for Virtual Machines. Attackers leveraged hard-coded default credentials for the `admin` user, found within `/home/kos/tomcat9/tomcat-users.xml`, to authenticate to the appliance's Apache Tomcat Manager. This unauthorized access allowed UNC6201 to upload a malicious WAR file via the `/manager/text/deploy` endpoint, subsequently executing commands with `root` privileges on the appliance. In observed incidents, this process led to the deployment of the SLAYSTYLE web shell, facilitating further malicious activities.

### GRIMBOLT Malware Analysis

GRIMBOLT represents an evolution in UNC6201's toolset. It is a C#-written foothold backdoor compiled using native ahead-of-time (AOT) compilation and packed with `UPX`. This approach complicates static analysis by removing the common intermediate language (CIL) metadata typical of C# applications and enhances performance on resource-constrained appliances. GRIMBOLT offers remote shell capabilities and utilizes the same command and control infrastructure as the previously deployed BRICKSTORM payload. In September 2025, Mandiant observed a campaign featuring the replacement of older BRICKSTORM binaries with GRIMBOLT, indicating a potential tradecraft shift or response to incident response efforts.

Persistence for GRIMBOLT and BRICKSTORM backdoors on Dell RecoverPoint for Virtual Machines was achieved by modifying the legitimate shell script `/home/kos/kbox/src/installation/distribution/convert_hosts.sh` to include the backdoor's path. This script is executed at boot time via `rc.local`, ensuring persistent unauthorized access.

### UNC6201's Advanced VMware TTPs

UNC6201 has continued to compromise VMware virtual infrastructure, exhibiting several previously unreported tactics:

*   **Ghost NICs:** The threat actor created new temporary network ports on existing virtual machines running on ESXi servers. These ephemeral interfaces were then used to pivot stealthily to internal and software-as-a-service (SaaS) infrastructures within affected organizations.
*   **iptables Proxying for Single Packet Authorization (SPA):** On compromised vCenter appliances, UNC6201 utilized `iptables` commands for SPA. This sophisticated technique involved:
    *   Monitoring incoming traffic on port 443 for a specific hexadecimal string.
    *   Adding the source IP of traffic containing this string to a temporary approved list.
    *   Accepting connections to port 10443 from IPs on the approved list.
    *   Silently redirecting any subsequent traffic to port 443 to port 10443 for a duration of 300 seconds (five minutes) if the IP remained on the approved list.

Example `iptables` commands observed:
```plain
iptables -I INPUT -i eth0 -p tcp --dport 443 -m string --hex-string <HEX_STRING>
iptables -A port_filter -i eth0 -p tcp --dport 10443 --syn -m recent --rcheck --name ipt -j ACCEPT
iptables -t nat -N IPT
iptables -t nat -A IPT -p tcp -j REDIRECT --to-ports 10443
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 --syn -m recent --rcheck --name ipt --seconds 300 -j IPT
```

## Actionable Recommendations and Mitigations

Defenders should prioritize patching Dell RecoverPoint for Virtual Machines to address CVE-2026-22769 immediately. Furthermore, organizations should review their VMware infrastructure for indicators of compromise related to UNC6201's TTPs.

### Forensic Analysis of Dell RecoverPoint Disk Image

Incident responders conducting full disk image analysis of Dell RecoverPoint for Virtual Machines should examine the following high-value artifacts:

*   **Web logs for Tomcat Manager:** Check `/home/kos/auditlog/fapi_cl_audit_log.log` for suspicious requests to `/manager`, particularly `PUT /manager/text/deploy?path=/<MAL_PATH>&update=true` which indicates malicious WAR file uploads.
*   **Uploaded WAR files:** Investigate `/var/lib/tomcat9` for unauthorized WAR files.
*   **Compiled WAR artifacts:** Examine `/var/cache/tomcat9/Catalina` for compiled artifacts.
*   **Tomcat application logs:** Review `/var/log/tomcat9/` for unusual events:
    *   `Catalina` logs: Look for `org.apache.catalina.startup.HostConfig.deployWAR` events.
    *   `Localhost` logs: Investigate events related to WAR deployment and exceptions generated by malicious files.
*   **Persistence modifications:** Inspect `/home/kos/kbox/src/installation/distribution/convert_hosts.sh` for unauthorized modifications that include paths to backdoors like BRICKSTORM or GRIMBOLT.

### Indicators of Compromise (IOCs)

Organizations should leverage the following indicators for detection and hunting:

**File Indicators (SHA256):**

*   **GRIMBOLT:**
    *   `24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c` (support)
    *   `dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591` (out_elf_2)
*   **SLAYSTYLE:**
    *   `92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a` (default_jsp.java)
*   **BRICKSTORM:**
    *   `aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878`
    *   `2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df` (splisten)
    *   `320a0b5d4900697e125cebb5ff03dee7368f8f087db1c1570b0b62f5a986d759`
    *   `90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035`
    *   `45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830`

**Network Indicators:**

*   **GRIMBOLT C2 Endpoint:** `wss://149.248.11.71/rest/apisession`
*   **GRIMBOLT C2 IP:** `149.248.11.71`

### YARA Rules

The following YARA rules can assist in identifying GRIMBOLT and SLAYSTYLE malware:

**G_APT_BackdoorToehold_GRIMBOLT_1**
```plain
rule G_APT_BackdoorToehold_GRIMBOLT_1
{
  meta:
    author = "Google Threat Intelligence Group (GTIG)"
  strings:
    $s1 = { 40 00 00 00 41 18 00 00 00 4B 21 20 C2 2C 08 23 02 }
    $s2 = { B3 C3 BB 41 0D ?? ?? ?? 00 81 02 0C ?? ?? ?? 00 }
    $s3 = { 39 08 01 49 30 A0 52 30 00 00 00 DB 40 09 00 02 00 80 65 BC 98 }
    $s4 = { 2F 00 72 00 6F 00 75 00 74 00 65 79 23 E8 03 0E 00 00 00 2F 00 70 00 72 00 6F 00 63 00 2F 00 73 00 65 00 6C 00 66 00 2F 00 65 00 78 00 65 }
  condition:
    (uint32(0) == 0x464c457f) //linux
    and all of ($s*)
}
```

**G_Hunting_BackdoorToehold_GRIMBOLT_1**
```plain
rule G_Hunting_BackdoorToehold_GRIMBOLT_1
{
    meta:
        author = "Google Threat Intelligence Group (GTIG)"

    strings:
        $s1 = "[!] Error : Plexor is nul" ascii wide
        $s2 = "port must within 0~6553" ascii wide
        $s3 = "[*] Disposing.." ascii wide
        $s4 = "[!] Connection error. Kill Pty" ascii wide
        $s5 = "[!] Unkown message type" ascii wide
        $s6 = "[!] Bad dat" ascii wide
    condition:
        (
            (uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550) or
            uint32(0) == 0x464c457f or
            uint32(0) == 0xfeedface or
            uint32(0) == 0xcefaedfe or
            uint32(0) == 0xfeedfacf or
            uint32(0) == 0xcffaedfe or
            uint32(0) == 0xcafebabe or
            uint32(0) == 0xbebafeca or
            uint32(0) == 0xcafebabf or
            uint32(0) == 0xbfbafeca
        ) and any of them
}
```

**G_APT_BackdoorWebshell_SLAYSTYLE_4**
```plain
rule G_APT_BackdoorWebshell_SLAYSTYLE_4
{
	meta:
		author = "Google Threat Intelligence Group (GTIG)"
	strings:
		$str1 = "<%@page import=\"java.io" ascii wide
		$str2 = "Base64.getDecoder().decode(c.substring(1)" ascii wide
		$str3 = "{\"/bin/sh\",\"-c\"" ascii wide
		$str4 = "Runtime.getRuntime().exec(" ascii wide
		$str5 = "ByteArrayOutputStream();" ascii wide
		$str6 = ".printStackTrace(" ascii wide
	condition:
		$str1 at 0 and all of them
}
```

**Related:** [Iranian APT MuddyWater Orchestrates Operation Olalampo Targeting MENA Infrastructure](/blog/iranian-apt-muddywater-orchestrates-operation-olalampo-targeting-mena-infrastructure), [Community-Driven Intelligence Architectures and Virtualization Vulnerability Analysis](/blog/community-driven-intelligence-architectures-and-virtualization-vulnerability-analysis)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/unc6201-exploits-dell-recoverpoint-zero-day-cve-2026-22769