Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 GRIMBOLT Backdoor (CVE-2026-22769)

Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 (TL-2026-0194), also tracked as Operation GhostBackup, is a critical-severity software vulnerability scored CVSS 10, first published 2026-03-07. It is attributed to UNC6201 (China) with high confidence, affects Dell RecoverPoint for Virtual Machines, references 1 CVE (CVE-2026-22769), maps to 16 MITRE ATT&CK techniques (T1021, T1027, T1037), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-0194

Threat ID
TL-2026-0194
Also known as
Operation GhostBackup
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-03-07
Last reviewed
2026-03-07
Attribution
UNC6201
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government, financial, healthcare, technology, defense, critical-infrastructure, energy
Target regions
North America, Europe, Asia Pacific
Detection rules
9
Indicators of compromise
24

Malware and tooling in Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

Malware and tooling: BRICKSTORM - S9015, GRIMBOLT, SLAYSTYLE, GRIMBOLT WebSocket C2

Critical hardcoded credentials vulnerability (CVSS 10.0) in Dell RecoverPoint for Virtual Machines allows unauthenticated remote attackers to gain root-level access. China-nexus threat actor UNC6201 has exploited this zero-day since mid-2024, deploying SLAYSTYLE web shells, BRICKSTORM and GRIMBOLT C# backdoors, with VMware ESXi 'Ghost NIC' persistence and iptables port knocking for covert lateral movement.

How Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 works

CVE-2026-22769 is a critical hardcoded credential vulnerability (CVSS 10.0) in Dell RecoverPoint for Virtual Machines, a disaster recovery orchestration platform used to manage replication and failover of virtualized workloads. The vulnerability stems from hard-coded administrative credentials stored in the Apache Tomcat configuration file (/home/kos/tomcat9/tomcat-users.xml), allowing unauthenticated remote attackers to authenticate to the Tomcat Manager interface and deploy malicious WAR archives.

The full attack chain proceeds as follows: (1) The attacker uses the hardcoded 'admin' credential to authenticate to the Dell RecoverPoint Tomcat Manager. (2) A malicious Java web shell named SLAYSTYLE is deployed via the /manager/text/deploy endpoint. (3) The web shell provides root-level command execution on the underlying Linux appliance. (4) The BRICKSTORM C# backdoor is installed for persistent remote access. (5) In September 2025, UNC6201 replaced BRICKSTORM with GRIMBOLT, a newer C# backdoor compiled using Native Ahead-of-Time (AOT) compilation and packed with UPX, making static analysis significantly harder.

For persistence, UNC6201 modifies a legitimate boot-time shell script (convert_hosts.sh) located at /home/kos/kbox/src/installation/distribution/convert_hosts.sh. This script is executed by the appliance at boot time via rc.local, ensuring backdoor execution survives reboots.

For lateral movement, UNC6201 employs a novel technique involving the creation of temporary virtual network interfaces ('Ghost NICs') on VMware ESXi virtual machines. These hidden network adapters allow the threat actor to pivot between virtual machines and into internal or cloud-based environments without being detected by network monitoring. The Ghost NICs are deleted post-exploitation to hinder forensic investigation.

Additionally, UNC6201 implements iptables-based Single Packet Authorization (SPA) port knocking. The actor configures iptables rules to monitor port 443 for a specific HEX string. Only after this 'knock' is received is the source IP added to an approved whitelist, allowing subsequent traffic to be redirected from port 443 to a hidden listener on port 10443, with a 5-minute connection window.

GRIMBOLT communicates with C2 infrastructure via WebSocket connections. Team Cymru's March 2026 analysis identified three C2 servers (149.248.11.71, 140.82.18.134, 66.42.111.219) all hosted on Vultr (AS20473), sharing an X.509 certificate with subject CN=WIN-DO6FVJH67FN. All three servers expose RDP (3389), with two also exposing MS HTTP API (5357) and WinRM (5985).

UNC6201 is a suspected PRC-nexus cyberespionage cluster with notable tactical overlaps with UNC5221, though Mandiant assesses them as distinct groups. BRICKSTORM usage has also been linked to threat actors tracked as Warp Panda and Clay Typhoon. The campaign primarily targets organizations in North America that lack EDR coverage on backup infrastructure appliances.

CISA added CVE-2026-22769 to the Known Exploited Vulnerabilities catalog on February 18, 2026, requiring Federal Civilian Executive Branch agencies to patch within 3 days (by February 21, 2026). Dell released hotfix 6.0.3.1 HF1 and an interim remediation script.

---

**Revalidated on 2026-03-12**

POST-REVALIDATION NOTES (2026-03-12):

1. ALIAS ACCURACY: The 'Clay Typhoon' alias listed for UNC6201 could not be independently verified through open-source intelligence. CrowdStrike tracks this cluster as 'Warp Panda' and Malpedia confirms this designation. Microsoft's Typhoon naming convention has not publicly assigned 'Clay Typhoon' to this specific cluster as of this date. Recommend flagging this alias as 'UNVERIFIED' or sourcing the attribution.

2. WARP PANDA CONTEXT: CrowdStrike's Warp Panda reporting (Summer 2025, Cyber Daily / Infosecurity Magazine) documents the same actor targeting VMware vCenter environments and deploying BRICKSTORM on vCenter servers, along with two previously unobserved Golang implants — Junction (ESXi host persistence) and GuestConduit (guest VM C2). These additional tooling families (Junction, GuestConduit) are not mentioned in TL-2026-0194 but represent related UNC6201/Warp Panda capabilities that defenders should be aware of.

3. VICTIM SCOPE: Mandiant reports fewer than a dozen impacted organizations, primarily in North America. The existing write-up does not specify victim count or geography — consider adding target_regions specificity.

4. REMEDIATION PATH CLARIFICATION: Dell's advisory specifies that systems on 5.3 SP4 P1 must first migrate to 6.0 SP3 before upgrading to 6.0.3.1 HF1. Alternatively, an interim remediation script (KB 000426742) can be applied. The current remediation section should clarify this migration path dependency.

5. AFFECTED VERSION EXPANSION: Web search results confirm affected versions include 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, 6.0 SP3 P1 (all pre-6.0.3.1 HF1). The existing affected versions list already covers these. RecoverPoint Classic is NOT vulnerable — this could be noted explicitly.

6. SLAYSTYLE DEPLOYMENT PATH: Web sources confirm the SLAYSTYLE web shell was deployed into /var/lib/tomcat9 and /var/cache/tomcat9/Catalina directories specifically. Consider adding these as file IOC paths.

7. MANDIANT GTI COLLECTION: Mandiant has published a free Google Threat Intelligence (GTI) Collection with IOCs and YARA rules for registered users. This collection was not referenced in the existing references — it provides the authoritative IOC feed for this threat.

MITRE ATT&CK techniques used in TL-2026-0194

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1078 Valid Accounts; T1205 Traffic Signaling

persistence

T1037 Boot or Logon Initialization Scripts; T1505 Server Software Component

execution

T1059 Command and Scripting Interpreter

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol; T1571 Non-Standard Port; T1572 Protocol Tunneling

initial-access

T1190 Exploit Public-Facing Application

resource-development

T1587 Develop Capabilities; T1588 Obtain Capabilities

defense-impairment

T1599 Network Boundary Bridging

Affected products and versions in Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

  • Dell — RecoverPoint for Virtual Machines
    Vulnerable versions: 5.3 SP2; 5.3 SP3; 5.3 SP4; 6.0; 6.0 SP1; 6.0 SP1 P1; 6.0 SP1 P2; 6.0 SP2; 6.0 SP2 P1; 6.0 SP3
    Fixed in: 6.0.3.1 HF1; 5.3 SP4 P1 (interim)

Remediation for Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

Patches

  • Dell RecoverPoint for VMs 6.0.3.1 HF1 (versions 6.0+)
  • Upgrade to 5.3 SP4 P1 for older 5.x deployments before upgrading to 6.x
  • Dell interim remediation script: KB 000426742

Immediate actions

  • Block C2 IPs at perimeter: 149.248.11.71, 140.82.18.134, 66.42.111.219
  • Restrict network access to Dell RecoverPoint Tomcat Manager interface
  • Hunt for SLAYSTYLE, BRICKSTORM, and GRIMBOLT file hashes across environment
  • Check /home/kos/kbox/src/installation/distribution/convert_hosts.sh for unauthorized modifications
  • Audit ESXi virtual machines for unexpected network adapters (Ghost NICs)
  • Monitor for iptables rules redirecting port 443 traffic to port 10443
  • Apply Dell interim remediation script from KB 000426742

Workarounds

  • Deploy RecoverPoint within trusted, access-controlled internal network with firewall restrictions
  • Block external access to Tomcat Manager on RecoverPoint appliances
  • Apply Dell interim remediation script pending full hotfix deployment
  • Disable Tomcat Manager web application if not required

Longer-term hardening

  • Upgrade to Dell RecoverPoint for Virtual Machines 6.0.3.1 HF1
  • Deploy EDR agents on all backup infrastructure appliances
  • Implement network segmentation isolating backup infrastructure from production
  • Enable TLS certificate monitoring for anomalous X.509 certificates
  • Deploy YARA rules for GRIMBOLT and SLAYSTYLE detection
  • Audit Tomcat Manager access logs at /home/kos/auditlog/fapi_cl_audit_log.log
  • Implement network monitoring for WebSocket-based C2 communications

CVEs associated with Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

CVE-2026-22769

Weaknesses (CWE) in Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

CWE-798

Timeline of Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

  • UNC6201 begins active exploitation of CVE-2026-22769 zero-day in Dell RecoverPoint for Virtual Machines, deploying BRICKSTORM backdoor
  • UNC6201 replaces BRICKSTORM with GRIMBOLT, a C# backdoor compiled using Native AOT and packed with UPX, on compromised RecoverPoint appliances
  • Department of Defense publishes Malware Analysis Report on BRICKSTORM backdoor
  • X.509 certificate (CN=WIN-DO6FVJH67FN) issued for GRIMBOLT C2 infrastructure on Vultr (AS20473)
  • Mandiant and Google Threat Intelligence Group publicly disclose CVE-2026-22769 and UNC6201 campaign. CISA adds to Known Exploited Vulnerabilities catalog
  • Dell publishes Security Advisory DSA-2026-079 with hotfix 6.0.3.1 HF1 and interim remediation script
  • CISA patch deadline for Federal Civilian Executive Branch agencies (3-day emergency timeline)
  • Team Cymru publishes C2 infrastructure analysis identifying two additional GRIMBOLT C2 servers via X.509 certificate pivoting
  • CISA and industry continue tracking active exploitation; additional threat intelligence reports published by multiple vendors
  • Penligent publishes detailed attack-chain walkthrough of CVE-2026-22769 exploitation mechanics, highlighting backup infrastructure as a systemic trust boundary problem [Source: https://www.penligent.ai/hackinglabs/cve-2026-22769-and-the-backup-infrastructure-trust-problem]
  • eSentire advisory confirms exploitation window spanning two full years (mid-2024 to Feb 2026) and provides customer-facing remediation guidance prioritizing network segmentation of RecoverPoint appliances [Source: https://www.esentire.com/security-advisories/dell-recoverpoint-vulnerability-exploited-for-two-years-cve-2026-22769]
  • As of 2026-05-29, CVE-2026-22769 is patched (Dell 6.0.3.1 HF1) and in CISA KEV, but actor UNC6201/Warp Panda is undisrupted with no arrests/takedown and Team Cymru-mapped GRIMBOLT C2 (Jan-2026 certs) assessed as live. CISA warns the broader BRICKSTORM espionage campaign is ongoing; unpatched, EDR-blind backup appliances remain at risk, so MONITORING.

Sources cited for Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

Threats related to Dell RecoverPoint Hardcoded Credentials RCE + UNC6201

Detection coverage for TL-2026-0194

As of 2026-03-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0194 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats