Back

Chinese Hackers Exploit Dell Zero-Day Flaw CVE-2026-22769 Since Mid-2024

Severity: High (Score: 70.4)

Sources: Bleepingcomputer, Scworld, Cyberscoop, Hackread, Facebook

Summary

A Chinese state-backed hacking group, UNC6201, has been exploiting a critical zero-day vulnerability in Dell RecoverPoint for Virtual Machines since at least mid-2024. The flaw, tracked as CVE-2026-22769, features a maximum severity rating due to hardcoded credentials, allowing unauthorized access to VMware virtual machine backups. This exploitation was revealed by Mandiant and the Google Threat Intelligence Group on February 17, 2026.

Key Entities

  • Silk Typhoon (apt_group)
  • Unc5221 (apt_group)
  • Unc6201 (apt_group)
  • Malware (attack_type)
  • Ransomware (attack_type)
  • Zero-day Exploit (attack_type)
  • Brickstorm Campaign (campaign)
  • Dell (company)
  • Dell Technologies (company)
  • China (country)
  • United States (country)
  • CVE-2026-20700 (cve)
  • CVE-2026-20805 (cve)
  • CVE-2026-22769 (cve)
  • Government (industry)
  • Manufacturing (industry)
  • Technology (industry)
  • 149.248.11.71 (ipv4)
  • Brickstorm (malware)
  • Grimbolt (malware)
  • Slaystyle (malware)
  • Spawnant (malware)
  • Zipline (malware)
  • T1021 - Remote Services (mitre_attack)
  • T1053 - Scheduled Task/Job (mitre_attack)
  • T1059 - Command and Scripting Interpreter (mitre_attack)
  • T1071 - Application Layer Protocol (mitre_attack)
  • T1078 - Valid Accounts (mitre_attack)
  • Apache Tomcat (platform)
  • Dell RecoverPoint For Virtual Machines (platform)
  • Dell RecoverPoint Zero GTIG (platform)
  • ESXi (platform)
  • RecoverPoint (platform)
  • VMware (tool)
  • Iptables (tool)
  • UPX (tool)
  • 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df (sha256)
  • 24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c (sha256)
  • 320a0b5d4900697e125cebb5ff03dee7368f8f087db1c1570b0b62f5a986d759 (sha256)
  • 45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830 (sha256)
  • 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035 (sha256)
  • RecoverPoint Zero-day (vulnerability)
Loading threat details...

Threat Not Found

The threat cluster you're looking for doesn't exist or has been removed.

Return to Feed