A critical vulnerability, tracked as CVE-2026-22769, in Dell RecoverPoint for Virtual Machines has been exploited by a Chinese nation-state threat group known as UNC6201 since mid-2024. This high-severity flaw, assigned a CVSS score of 10, arises from hard-coded admin credentials in the Apache Tomcat Manager configuration file. These credentials grant unauthenticated attackers the ability to upload malicious WAR files, achieving root-level persistence.
The exploited vulnerability has allowed the deployment of sophisticated malware such as Slaystyle, Brickstorm, and a novel C# backdoor named Grimbolt. Grimbolt is particularly notable for being compiled with native Ahead-Of-Time (AOT) compilation to resist reverse engineering. Attackers also employed ‘ghost NICs’ on VMware virtual machines to maintain stealthy network access, complicating detection efforts.
The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch it within three days, highlighting the urgency and seriousness of the threat. Although Mandiant has confirmed fewer than a dozen victims, the actual number might be significantly higher.
Dell addressed this security gap by releasing a patch (version 6.0.3.1 HF1) in February 2026 and providing a remediation script for organizations using vulnerable RecoverPoint versions. This incident underscores the risks associated with hard-coded credentials, often arising from legacy support accounts and internal endpoints that lack rigorous security reviews.
The continued exploitation of this flaw by UNC6201 reflects ongoing cyberespionage activities linked to suspected Chinese state-sponsored actors, illustrating both a calculated targeting of critical infrastructure and sophisticated deployment strategies to evade detection.

Collections

A critical CVSS 10 vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines has been actively exploited since mid-2024 by Chinese nation-state threat group UNC6201. The flaw stems from hard-coded admin credentials in the Apache Tomcat Manager config, enabling unauthenticated attackers to upload malicious WAR files and achieve root-level persistence. Attackers deployed advanced malware including Slaystyle, Brickstorm, and a novel AOT-compiled C# backdoor called Grimbolt, while using 'ghost NICs' on VMware VMs to evade detection. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch within three days. Dell released a patch (version 6.0.3.1 HF1) in February 2026 along with a remediation script.

Exploitation of Dell RecoverPoint Zero-Day by Chinese Hackers