A critical vulnerability in Dell RecoverPoint for Virtual Machines has been exploited by the suspected Chinese state-backed group UNC6201 since mid-2024, according to findings from Mandiant and the Google Threat Intelligence Group. This flaw, identified as CVE-2026-22769, allows unauthenticated remote attackers to gain unauthorized access to systems through hardcoded credentials, which poses severe security risks.
Dell's security advisory emphasizes the urgency for users to upgrade to version 6.0.3.1 HF1 or apply alternative remediation measures. The group has been deploying various malware, including a new backdoor known as Grimbolt, which is designed to evade detection and operate more efficiently than its predecessor, Brickstorm.
Additionally, UNC6201 has implemented advanced techniques, such as creating hidden network interfaces referred to as Ghost NICs on VMware ESXi servers, allowing them to navigate unnoticed within compromised networks. Mandiant highlighted that this method is unprecedented in their investigations.