On February 18, 2026, Google Threat Intelligence Group and Mandiant disclosed CVE-2026-22769, a zero-day vulnerability in Dell RecoverPoint for Virtual Machines exploited by the Chinese cyber-espionage group UNC6201 since at least mid-2024. The flaw, caused by hardcoded credentials, allows unauthenticated access to the underlying operating system with root privileges and long-term persistence. The discovery comes months after the activity began, underscoring how disaster-recovery systems represent a high-criticality attack surface with poor visibility for conventional defenses.
- CVE-2026-22769 is a zero-day vulnerability in Dell RecoverPoint for Virtual Machines caused by hardcoded credentials, affecting versions prior to 6.0.3.1 HF1
- Exploitation is attributed to UNC6201, a Chinese cyber-espionage group, with documented activity since at least mid-2024
- The threat actor employed BrickStorm and GrimBolt malware, and the SlayStyle web shell, using "ghost NICs" on virtual machines for concealment
- The transition from BrickStorm to GrimBolt in September 2025 signals active arsenal evolution, either in response to detection or as part of a pre-planned development cycle
The Mechanism: Hardcoded Credentials in a Forgotten Perimeter
The vulnerability resides in Dell RecoverPoint for Virtual Machines, an appliance dedicated to replication and disaster recovery in virtualized environments. According to the Dell advisory cited by SecurityWeek, "[CVE-2026-22769] is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence."
Affected versions are those prior to 6.0.3.1 HF1. The fix, available since February 2026, stops further exploitation but does not retroactively resolve the months of dwell time accumulated in compromised networks. The hardcoded nature of the credential means the same username-password pair exists in all unpatched instances of the product, making exploitation highly repeatable and scalable.
UNC6201's Arsenal: From BrickStorm to GrimBolt
GTIG and Mandiant document the use of three distinct tools. BrickStorm represents the initial component, later replaced. In September 2025, UNC6201 introduced GrimBolt, a backdoor developed in C# and compiled with Ahead-of-Time (AOT) compilation, then packed with UPX. Execution provides the operator with a remote shell. The transition between the two malware families is noted by the source with a specific caveat: "It's unclear if the threat actor's replacement of BrickStorm with GrimBolt was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response efforts."
SlayStyle serves as a web shell, enabling persistent access via a web interface. The combination of a compiled backdoor and a web shell reflects a redundant architecture: blocking one channel leaves the alternative active.
The dossier does not specify BrickStorm's exact function or the reasons for its abandonment. It also does not indicate whether GrimBolt presents substantial differences in operational capabilities beyond the different compilation technique.
Ghost NICs: Anti-Forensics in Virtualized Environments
UNC6201 adopted a concealment technique specific to virtual environments: the creation of "ghost NICs," virtual network interfaces added to compromised machines and subsequently deleted. The manipulation serves to mask lateral movement and complicate post-incident forensic analysis, since the network card leaves no persistent traces in the VM configuration.
The use of virtual NICs as a concealment vector aligns with the deep knowledge of VMware infrastructure that characterizes this threat actor. The dossier does not specify, however, whether the technique was employed systematically or only against a subset of victims, nor whether virtualization monitoring tools can detect its transient creation.
"Nation-state threat actors continue to target systems that typically do not support EDR solutions, making it very difficult for victim organizations to know they are compromised and significantly prolonging intrusion dwell times" — Charles Carmakal, CTO Mandiant (LinkedIn), reported by SecurityWeek
The Link to UNC5221 and the Limits of Attribution
The source reports links between UNC6201 and UNC5221, a Chinese APT known for long dwell times in compromised networks. A reference to a Google report from September 2025 suggests documented overlaps in infrastructure or tactics. However, the dossier does not establish whether CVE-2026-22769 was one of the zero-days identified by UNC5221 via stolen information; this correlation is explicitly marked as "unclear" by the source.
UNC6201 also represents a "first public mention" in the GTIG/Mandiant report. No prior references document activity under this identifier, making it impossible to trace its operational history outside the declared period.
Immediate Actions
Organizations using Dell RecoverPoint for Virtual Machines must update immediately to version 6.0.3.1 HF1, the only version that eliminates the CVE-2026-22769 vulnerability. The update blocks new access via the hardcoded credentials but does not remove backdoors or web shells already installed.
GTIG and Mandiant have released indicators of compromise (IoCs) for detection of GrimBolt, BrickStorm, and SlayStyle. Security teams must verify the presence of these IoCs in virtualized environments, with particular attention to logs of network interface creation and destruction on VMs that may signal the use of the ghost NIC technique.
The lack of EDR support on disaster-recovery appliances requires alternative monitoring at the hypervisor and network level, the area where UNC6201 operated with prolonged invisibility. Organizations should consider forensic inspection of RecoverPoint systems running versions prior to 6.0.3.1 HF1, regardless of the absence of security alerts.
Who Is UNC6201 and What Distinguishes This Campaign
UNC6201 is designated as a Chinese cyber-espionage group. The dossier does not specify the precise geographic origin within China or preferred target sectors. The ghost NIC technique and the use of AOT-compiled backdoors suggest familiarity with enterprise virtualized environments, but the source does not quantify the number of victims or the geography of attacks.
The availability of IoCs released by GTIG and Mandiant provides a basis for detection, but the brief does not document whether these indicators are already integrated into commercial threat intelligence platforms.
FAQ
What exactly is a "ghost NIC" and why is it hard to detect?
A ghost NIC is a virtual network interface created temporarily on a virtual machine and then deleted. Its transient nature makes it absent from static configurations and forensic images acquired after removal, requiring real-time hypervisor monitoring for detection.
Why does GrimBolt use AOT compilation and UPX packing?
Ahead-of-Time compilation generates native binaries without dependency on the traditional .NET runtime, reducing the detection surface based on framework artifacts. UPX adds a compression layer that can hinder automated static analysis. The source does not document whether these choices actually evaded specific security controls.
Does the patch also resolve compromises that have already occurred?
No. Updating to 6.0.3.1 HF1 eliminates the vulnerability, preventing new access via the hardcoded credentials, but does not remove any backdoors or web shells previously installed. The brief does not indicate remediation procedures for already-compromised systems.
Sources
Information is based on the cited source and current as of publication.