Chinese APT Group Exploits Dell Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-22769 | Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access Dell RecoverPoint for Virtual Machines (RP4VMs) versions prior to 6.0.3.1 HF1 contain hard-coded credentials (CWE-798) for the appliance's underlying operating system. An unauthenticated remote attacker who knows the hard-coded credential can authenticate over the network with no user interaction and gain root-level access and persistence on the underlying OS — beyond just the RecoverPoint application — which is why the flaw scores a maximum CVSS of 10.0 with scope changed. Any organization running an affected RP4VMs release is exposed, with risk highest where appliance management interfaces are reachable from broader networks. The vulnerability is confirmed exploited in the wild: it was added to CISA's KEV catalog on 2026-02-18, and reporting indicates China-linked actors exploited it as a zero-day since at least 2024, prompting an emergency federal patch directive; related coverage ties the activity to the China-linked VerdantBamboo actor deploying BRICKSTORM-family backdoors on appliances. Do: Upgrade all RP4VMs appliances to 6.0.3.1 HF1 or apply Dell's published remediations immediately — federal agencies must patch per BOD 22-01 by the KEV deadline (reported as 'by Saturday'). Because exploitation has occurred since at least 2024, treat deployed appliances as potentially compromised: review the underlying OS for unexpected accounts, modified services, and root persistence, and restrict the appliance's management/replication network reachability until patched. | 10.0 | 13% | KEV |
| moderate≈ tens of thousands of appliances worldwide (estimated from deployment patterns; internet-exposed count unknown) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 6.0.3.1 | versions of the data backup and recovery solution prior to 6.0.3.1 HF1. Read more on Chinese APT groups: European Governments |
Full article417 words · extracted from infosecurity-magazine.com · click to collapse
Dell has released a patch for a critical zero-day vulnerability in its RecoverPoint for Virtual Machines product, which Mandiant said has been silently exploited by a Chinese APT group since 2024.
CVE-2026-22769 is a hardcoded credential bug with a maximum CVSS score of 10.0.
An unauthenticated attacker with knowledge of the credential could easily gain access to the underlying OS and root-level persistence, Dell warned.
The zero-day vulnerability affects versions of the data backup and recovery solution prior to 6.0.3.1 HF1.
Read more on Chinese APT groups: European Governments Breached in Zero-Day Attacks Targeting Ivanti.
Mandiant said in a report published on February 18 that it traced back exploitation of CVE-2026-22769 as far as mid-2024, although there may have been activity prior to this.
“Analysis of incident response engagements revealed that UNC6201, a suspected PRC-nexus threat cluster, has exploited this flaw since at least mid-2024 to move laterally, maintain persistent access, and deploy malware including Slaystyle, Brickstorm, and a novel backdoor tracked as Grimbolt,” it explained.
“The initial access vector for these incidents was not confirmed, but UNC6201 is known to target edge appliances (such as VPN concentrators) for initial access.”
In September last year, the group replaced the Brickstorm backdoor, which has been tied to Chinese cyber-espionage activity since at least March that year, with Grimbolt.
The new backdoor is apparently written in C# and compiled using native ahead-of-time (AOT) techniques to help evade analysis and improve performance.
“Unlike traditional .NET software that uses just-in-time (JIT) compilation at runtime, Native AOT-compiled binaries, introduced to .NET in 2022, are converted directly to machine-native code during compilation,” Mandiant explained.
“This approach enhances the software’s performance on resource-constrained appliances, ensures required libraries are already present in the file, and complicates static analysis by removing the common intermediate language (CIL) metadata typically associated with C# samples.”
Grimbolt, which provides a remote shell capability, uses the same command-and-control (C2) infrastructure as Brickstorm, the report added.
Mandiant Reveals Novel TTPs
Mandiant also observed UNC6201 using novel tactics to target VMware virtual infrastructure.
This includes the creation of new temporary network ports, or “ghost NICs,” on VMs running on an ESXi server.
“Using these network ports, the threat actor then pivoted to various internal and software-as-a-service (SaaS) infrastructures used by the affected organizations,” the report noted.
Mandiant also revealed the use of iptables for single packet authorization (SPA).
The report claimed there are overlaps between UNC6201 and UNC5221, which has been tied to zero-day attacks on government agencies using Ivanti products.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/chinese-apt-exploits-dell-zeroday/