{"id":7157,"date":"2026-02-18T21:43:40","date_gmt":"2026-02-18T21:43:40","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=7157"},"modified":"2026-02-18T21:43:40","modified_gmt":"2026-02-18T21:43:40","slug":"chinese-hackers-exploited-zero-day-dell-recoverpoint-flaw-for-1-5-years","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=7157","title":{"rendered":"Chinese hackers exploited zero-day Dell RecoverPoint flaw for 1.5 years"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

For the past 18 months, a Chinese cyberespionage group has been exploiting a prevously unknown vulnerability in Dell\u2019s RecoverPoint for Virtual Machines, a VM disaster recovery solution. The flaw, patched by Dell this week<\/a>, allows unauthenticated attackers to gain command execution on the underlying OS as root.<\/p>\n

The vulnerability, tracked as CVE-2026-22769<\/a>, stems from hardcoded admin credentials for the Apache Tomcat Manager, which can be leveraged to deploy malicious WAR (Web Application Archive) files. Apache Tomcat is a web server for Java-based web applications.<\/p>\n

Researchers from Google\u2019s Mandiant team discovered the critical vulnerability<\/a> while investigating multiple compromised Dell RecoverPoint for Virtual Machines instances in a customer environment sending out command-and-control (C2) traffic associated with two backdoos known as BRICKSTORM and GRIMBOLT. These backdoors are used by a China-linked APT group that Mandiant tracks as UNC6201, which is known to target VMware-related enterprise infrastructure<\/a>.<\/p>\n

Dell RecoverPoint for Virtual Machines is a data replication and protection appliance for VMware environments, which makes it an attractive target for this group. The new vulnerability affects versions 5.3 SP4 P1, 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1. Customers are strongly encouraged to upgrade to the patched 6.0.3.1 HF1 version, but if that\u2019s not immediately possible Dell also released a remediation script<\/a>.<\/p>\n

Attackers upgrade from BRICKSTORM to GRIMBOLT<\/h2>\n

UNC6201\u2019s activities overlap significantly with another group that Mandiant and Google\u2019s Threat Intelligence Group (GTIG) track as UNC5221, which is known for targeting network-edge appliances using zero-day exploits. Other security companies attribute this activity to the Chinese state-sponsored hacker group Silk Typhoon<\/a> or APT27, but Google believes this to be a different threat actor.<\/p>\n

UNC5221 has compromised the networks of US legal services firms, SaaS providers, business process outsourcers, and technology companies<\/a> over the past few years and deployed Linux backdoor BRICKSTORM and a web shell called SLAYSTYLE that has been installed on compromised vCenter deployments.<\/p>\n

Both BRICKSTORM and SLAYSTYLE have also been observed in the new Dell RecoverPoint compromises attributed to UNC6201. However, the threat actor also deployed a new backdoor called GRIMBOLT.<\/p>\n

\u201cGRIMBOLT is a C#-written foothold backdoor compiled using native ahead-of-time (AOT) compilation and packed with UPX,\u201d Mandiant\u2019s researchers said. \u201cIt provides a remote shell capability and uses the same command and control as previously deployed BRICKSTORM payload.\u201d<\/p>\n

There is evidence that UNC6201 has been exploiting CVE-2026-22769 since mid-2024 to deploy the SLAYSTYLE web shell. However, the replacement of BRICKSTORM with GRIMBOLT did not happen until September 2025. It\u2019s not clear if this was the result of planned iteration or as a reaction to BRICKSTORM being exposed by Mandiant and other security companies at around that time.<\/p>\n

Pivot techniques<\/h2>\n

In addition to the payloads themselves, the investigation also revealed new techniques. For example, the legitimate shell script convert_hosts.sh that exists on these appliances has been modified to include the path of the backdoors to achieve persistence.<\/p>\n

The SLAYSTYLE web shell, which is designed to receive commands over HTTP and execute them on the system, was used to set up proxy rules via the Linux iptables utility. Namely, incoming traffic on port 443 (HTTPS) that contained a particular HEX string was silently redirected to port 10443 for the next 5 minutes.<\/p>\n

Another novel technique was the creation of temporary network ports on existing virtual machines on VMware ESXi servers to access other services inside the environments.<\/p>\n

Charles Carmakal, CTO at Mandiant, described the technique on LinkedIn<\/a> as deploying \u201cghost NICs on virtual machines to evade defenders\u201d because it left investigators chasing network activity from IP addresses that no longer existed and were never documented.<\/p>\n

Network-edge appliances have become a common entry point into enterprise networks<\/a> for sophisticated attackers. These appliances are not typically covered by logging solutions, lack endpoint malware detection, yet contain troves of credentials and provide great pivot points to internal services.<\/p>\n

Dell recommends RecoverPoint for VMs be deployed inside a trusted, access-controlled network behind appropriate firewalls and segmentation, not on public-facing infrastructure. Meanwhile, the Mandiant blog post includes indicators of compromise and YARA detection rules for the new GRIMBOLT and SLAYSTYLE payloads.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

For the past 18 months, a Chinese cyberespionage group has been exploiting a prevously unknown vulnerability in Dell\u2019s RecoverPoint for Virtual Machines, a VM disaster recovery solution. The flaw, patched by Dell this week, allows unauthenticated attackers to gain command execution on the underlying OS as root. The vulnerability, tracked as CVE-2026-22769, stems from hardcoded […]<\/p>\n","protected":false},"author":0,"featured_media":7158,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-7157","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/7157"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7157"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/7157\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/7158"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}