# Dell RecoverPoint Hardcoded Credentials RCE + UNC6201 GRIMBOLT Backdoor (CVE-2026-22769)

> Critical hardcoded credentials vulnerability (CVSS 10.0) in Dell RecoverPoint for Virtual Machines allows unauthenticated remote attackers to gain root-level access. China-nexus threat actor UNC6201 has exploited this zero-day since mid-2024, deploying SLAYSTYLE web shells, BRICKSTORM and GRIMBOLT C# backdoors, with VMware ESXi 'Ghost NIC' persistence and iptables port knocking for covert lateral movement.

- **Published:** 2026-03-07T12:00:00Z
- **Last reviewed:** 2026-03-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0194
- **ID:** TL-2026-0194
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Actor:** UNC6201 (China)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-22769

## Description

CVE-2026-22769 is a critical hardcoded credential vulnerability (CVSS 10.0) in Dell RecoverPoint for Virtual Machines, a disaster recovery orchestration platform used to manage replication and failover of virtualized workloads. The vulnerability stems from hard-coded administrative credentials stored in the Apache Tomcat configuration file (/home/kos/tomcat9/tomcat-users.xml), allowing unauthenticated remote attackers to authenticate to the Tomcat Manager interface and deploy malicious WAR archives.

The full attack chain proceeds as follows: (1) The attacker uses the hardcoded 'admin' credential to authenticate to the Dell RecoverPoint Tomcat Manager. (2) A malicious Java web shell named SLAYSTYLE is deployed via the /manager/text/deploy endpoint. (3) The web shell provides root-level command execution on the underlying Linux appliance. (4) The BRICKSTORM C# backdoor is installed for persistent remote access. (5) In September 2025, UNC6201 replaced BRICKSTORM with GRIMBOLT, a newer C# backdoor compiled using Native Ahead-of-Time (AOT) compilation and packed with UPX, making static analysis significantly harder.

For persistence, UNC6201 modifies a legitimate boot-time shell script (convert_hosts.sh) located at /home/kos/kbox/src/installation/distribution/convert_hosts.sh. This script is executed by the appliance at boot time via rc.local, ensuring backdoor execution survives reboots.

For lateral movement, UNC6201 employs a novel technique involving the creation of temporary virtual network interfaces ('Ghost NICs') on VMware ESXi virtual machines. These hidden network adapters allow the threat actor to pivot between virtual machines and into internal or cloud-based environments without being detected by network monitoring. The Ghost NICs are deleted post-exploitation to hinder forensic investigation.

Additionally, UNC6201 implements iptables-based Single Packet Authorization (SPA) port knocking. The actor configures iptables rules to monitor port 443 for a specific HEX string. Only after this 'knock' is received is the source IP added to an approved whitelist, allowing subsequent traffic to be redirected from port 443 to a hidden listener on port 10443, with a 5-minute connection window.

GRIMBOLT communicates with C2 infrastructure via WebSocket connections. Team Cymru's March 2026 analysis identified three C2 servers (149.248.11.71, 140.82.18.134, 66.42.111.219) all hosted on Vultr (AS20473), sharing an X.509 certificate with subject CN=WIN-DO6FVJH67FN. All three servers expose RDP (3389), with two also exposing MS HTTP API (5357) and WinRM (5985).

UNC6201 is a suspected PRC-nexus cyberespionage cluster with notable tactical overlaps with UNC5221, though Mandiant assesses them as distinct groups. BRICKSTORM usage has also been linked to threat actors tracked as Warp Panda and Clay Typhoon. The campaign primarily targets organizations in North America that lack EDR coverage on backup infrastructure appliances.

CISA added CVE-2026-22769 to the Known Exploited Vulnerabilities catalog on February 18, 2026, requiring Federal Civilian Executive Branch agencies to patch within 3 days (by February 21, 2026). Dell released hotfix 6.0.3.1 HF1 and an interim remediation script.

---

**Revalidated on 2026-03-12**

POST-REVALIDATION NOTES (2026-03-12):

1. ALIAS ACCURACY: The 'Clay Typhoon' alias listed for UNC6201 could not be independently verified through open-source intelligence. CrowdStrike tracks this cluster as 'Warp Panda' and Malpedia confirms this designation. Microsoft's Typhoon naming convention has not publicly assigned 'Clay Typhoon' to this specific cluster as of this date. Recommend flagging this alias as 'UNVERIFIED' or sourcing the attribution.

2. WARP PANDA CONTEXT: CrowdStrike's Warp Panda reporting (Summer 2025, Cyber Daily / Infosecurity Magazine) documents the same actor targeting VMware vCenter environments and deploying BRICKSTORM on vCenter servers, along with two previously unobserved Golang implants — Junction (ESXi host persistence) and GuestConduit (guest VM C2). These additional tooling families (Junction, GuestConduit) are not mentioned in TL-2026-0194 but represent related UNC6201/Warp Panda capabilities that defenders should be aware of.

3. VICTIM SCOPE: Mandiant reports fewer than a dozen impacted organizations, primarily in North America. The existing write-up does not specify victim count or geography — consider adding target_regions specificity.

4. REMEDIATION PATH CLARIFICATION: Dell's advisory specifies that systems on 5.3 SP4 P1 must first migrate to 6.0 SP3 before upgrading to 6.0.3.1 HF1. Alternatively, an interim remediation script (KB 000426742) can be applied. The current remediation section should clarify this migration path dependency.

5. AFFECTED VERSION EXPANSION: Web search results confirm affected versions include 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, 6.0 SP3 P1 (all pre-6.0.3.1 HF1). The existing affected versions list already covers these. RecoverPoint Classic is NOT vulnerable — this could be noted explicitly.

6. SLAYSTYLE DEPLOYMENT PATH: Web sources confirm the SLAYSTYLE web shell was deployed into /var/lib/tomcat9 and /var/cache/tomcat9/Catalina directories specifically. Consider adding these as file IOC paths.

7. MANDIANT GTI COLLECTION: Mandiant has published a free Google Threat Intelligence (GTI) Collection with IOCs and YARA rules for registered users. This collection was not referenced in the existing references — it provides the authoritative IOC feed for this threat.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1037 Boot or Logon Initialization Scripts
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1205 Traffic Signaling
- T1021 Remote Services
- T1599 Network Boundary Bridging
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1571 Non-Standard Port
- T1587 Develop Capabilities
- T1588 Obtain Capabilities

## Sources

- [Mandiant/GTIG: UNC6201 Exploiting Dell RecoverPoint Zero-Day](https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day)
- [Team Cymru: GRIMBOLT C2 Infrastructure Mapping and Reconnaissance](https://www.team-cymru.com/post/grimbolt-c2-infrastructure-mapping-and-reconnaisssance)
- [Dell Security Advisory DSA-2026-079](https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079)
- [CISA KEV Addition - CVE-2026-22769](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [The Hacker News: Dell RecoverPoint Zero-Day Exploited Since Mid-2024](https://thehackernews.com/2026/02/dell-recoverpoint-for-vms-zero-day-cve.html)
- [SecurityWeek: Dell RecoverPoint Zero-Day Exploited by Chinese Group](https://www.securityweek.com/dell-recoverpoint-zero-day-exploited-by-chinese-cyberespionage-group/)
- [BleepingComputer: CISA Orders Feds to Patch Dell Flaw Within 3 Days](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-dell-flaw-within-3-days/)
- [The Register: Dell Zero-Day Exploited by Suspected Chinese Snoops Since 2024](https://www.theregister.com/2026/02/18/dell_0day_brickstorm_campaign/)
- [Help Net Security: China-linked Hackers Exploited Dell Zero-Day Since 2024](https://www.helpnetsecurity.com/2026/02/18/exploited-dell-zero-day-cve-2026-22769-brickstorm-grimbolt/)
- [Hive Pro: CVE-2026-22769 UNC6201 Exploiting Dell RecoverPoint Zero-Day](https://hivepro.com/threat-advisory/cve-2026-22769-unc6201-exploiting-dell-recoverpoint-zero-day/)
- [SOC Prime: CVE-2026-22769 Critical Dell RecoverPoint Zero-Day](https://socprime.com/blog/cve-2026-22769-vulnerability/)
- [Truesec: Zero-Day in Dell RecoverPoint for Virtual Machines](https://www.truesec.com/hub/blog/zero-day-dell-recoverpoint-for-virtual-machines-cve-2026-22769)
- [DoD Malware Analysis Report: BRICKSTORM Backdoor](https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF)
- [CIS Advisory: Dell RecoverPoint Arbitrary Code Execution](https://www.cisecurity.org/advisory/a-vulnerability-in-dell-recoverpoint-for-virtual-machines-could-allow-for-arbitrary-code-execution_2026-015)
- [Dell Interim Remediation Script](https://www.dell.com/support/kbdoc/en-us/000426742)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0194