# Dell RecoverPoint for VMs Zero-Day (CVE-2026-22769) — CVSS 10.0, PRC-Nexus UNC6201/Silk Typhoon, BRICKSTORM/GRIMBOLT/SLAYSTYLE, VMware Ghost NIC Pivoting, iptables SPA

> Mandiant/GTIG discovered zero-day exploitation of CVE-2026-22769 (CVSS 10.0) in Dell RecoverPoint for Virtual Machines by UNC6201, a suspected PRC-nexus threat cluster with overlaps to Silk Typhoon. Hard-coded Tomcat Manager credentials enable unauthenticated WAR file deployment leading to root-level RCE. Active exploitation since mid-2024 deploying SLAYSTYLE webshells, BRICKSTORM backdoors, and a novel GRIMBOLT C# native AOT backdoor. Actor pivots into VMware infrastructure via Ghost NICs and iptables Single Packet Authorization.

- **Published:** 2026-02-21T12:00:00Z
- **Last reviewed:** 2026-02-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0123
- **ID:** TL-2026-0123
- **Severity:** CRITICAL (CVSS 10)
- **Category:** ZERO_DAY
- **Status:** MONITORING
- **Actor:** UNC6201 (China)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-22769

## Description

CVE-2026-22769 is a critical hardcoded credential vulnerability (CWE-798) in Dell RecoverPoint for Virtual Machines, all versions prior to 6.0.3.1 HF1. The vulnerability resides in the Apache Tomcat Manager configuration file (/home/kos/tomcat9/tomcat-users.xml), which contains hard-coded default credentials for the 'admin' user. An unauthenticated remote attacker with knowledge of these credentials can authenticate to the Tomcat Manager interface and deploy malicious WAR files via the /manager/text/deploy endpoint, achieving arbitrary code execution as root on the underlying appliance operating system.

Mandiant and Google Threat Intelligence Group (GTIG) identified this vulnerability during incident response engagements where Dell RecoverPoint for Virtual Machines appliances had active command-and-control (C2) beacons associated with BRICKSTORM and GRIMBOLT backdoors. The earliest confirmed exploitation dates to mid-2024, indicating approximately 8 months of zero-day exploitation before public disclosure.

The threat actor UNC6201 — a suspected PRC-nexus cluster with notable overlaps to UNC5221 (publicly reported as Silk Typhoon) — exploited CVE-2026-22769 to deploy SLAYSTYLE JSP webshells for initial foothold, then installed BRICKSTORM Go-based backdoors for persistent C2 access. In September 2025, Mandiant observed UNC6201 replacing BRICKSTORM binaries with GRIMBOLT, a novel backdoor written in C# and compiled using .NET native ahead-of-time (AOT) compilation, packed with UPX. Native AOT compilation eliminates Common Intermediate Language (CIL) metadata, complicating static analysis and reverse engineering while enhancing performance on resource-constrained appliance hardware.

GRIMBOLT provides remote shell capability and uses WebSocket-based C2 communication (wss://149.248.11.71/rest/apisession). Persistence is achieved by modifying the legitimate convert_hosts.sh boot script (/home/kos/kbox/src/installation/distribution/convert_hosts.sh), which executes via rc.local at system startup.

Beyond the Dell appliance exploitation, Mandiant documented novel VMware infrastructure pivoting techniques. The actor created temporary 'Ghost NICs' — ephemeral network ports on existing virtual machines running on ESXi servers — to pivot into internal networks and SaaS infrastructure. On compromised vCenter appliances, the actor deployed iptables rules implementing Single Packet Authorization (SPA): monitoring port 443 for a specific hex string trigger, adding the source IP to an approved list, then silently redirecting subsequent traffic to port 10443 for a 300-second window. This SPA mechanism provides a stealthy, time-limited access channel that is extremely difficult to detect with traditional network monitoring.

Dell released Security Advisory DSA-2026-079 on 2026-02-17, with remediation via upgrade to version 6.0.3.1 HF1 or application of a remediation script. The NVD confirmed the CVSS 10.0 score with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. CISA has added CVE-2026-22769 to the Known Exploited Vulnerabilities catalog. The trivial nature of exploitation (hard-coded credentials, no authentication required) combined with the 8-month exploitation window and nation-state actor involvement makes this a highest-priority threat for any organization running Dell RecoverPoint for Virtual Machines.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1037.004 RC Scripts
- T1068 Exploitation for Privilege Escalation
- T1027.002 Software Packing
- T1070.006 Timestomp
- T1036.005 Match Legitimate Resource Name or Location
- T1027.004 Compile After Delivery
- T1552.001 Credentials In Files
- T1003.003 NTDS
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1497.001 System Checks
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1021.004 SSH
- T1021.001 Remote Desktop Protocol
- T1114.002 Remote Email Collection
- T1213.003 Code Repositories
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090.003 Multi-hop Proxy
- T1573.002 Asymmetric Cryptography
- T1071.004 DNS
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1583.003 Virtual Private Server
- T1584.005 Botnet

## Sources

- [Mandiant/GTIG: UNC6201 Exploiting Dell RecoverPoint Zero-Day](https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day/)
- [Dell Security Advisory DSA-2026-079](https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079)
- [NVD — CVE-2026-22769](https://nvd.nist.gov/vuln/detail/CVE-2026-22769)
- [CISA KEV — CVE-2026-22769](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769)
- [GTIG: BRICKSTORM Espionage Campaign](https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign)
- [Dell RecoverPoint for VMs Remediation Script (KB 000426742)](https://www.dell.com/support/kbdoc/en-us/000426742)
- [Mandiant BRICKSTORM Scanner (GitHub)](https://github.com/mandiant/brickstorm-scanner)
- [GTI Collection — UNC6201 IOCs (VirusTotal)](https://www.virustotal.com/gui/collection/6d9bd98653d426b223007bbafb06ba4b83f83df8de01ee1463a8d60fb2be5107/summary)
- [NVISO — BRICKSTORM Windows Variant Report](https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf)
- [Mandiant: Defending vSphere from Threat Actors](https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944)
- [CrowdStrike: WARP PANDA Cloud Threats](https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/)
- [CISA Analysis Report AR25-338a](https://www.cisa.gov/news-events/analysis-reports/ar25-338a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0123