FROM BRICKSTORM TO GRIMBOLT: UNC6201 EXPLOITING A DELL RECOVERPOINT FOR VIRTUAL MACHINES ZERO-DAY

Summary from the TLDR InfoSec newsletter

Mandiant and GTIG described how UNC6201 exploited CVE-2026-22769 (CVSS 10.0), a hardcoded admin credential in Dell RecoverPoint's Apache Tomcat configuration located at /home/kos/tomcat9/tomcat-users.xml. This enabled unauthenticated deployment of WAR files via/manager/text/deploy and allowed root-level code execution. Persistence was maintained by hijacking convert_hosts.sh, which is run at boot via rc.local. GRIMBOLT, a C# backdoor replacing BRICKSTORM in September 2025, is compiled with native AOT to remove CIL metadata, making static analysis more difficult. It shares C2 infrastructure with its predecessor and introduces new lateral movement techniques in VMware, such as using "Ghost NICs" and iptables-based Single Packet Authorization on compromised vCenter appliances. Defenders should review /home/kos/auditlog/fapi_cl_audit_log.log for requests to /manager, search for GRIMBOLT using published YARA rules and IOCs, immediately apply Dell's patch, and monitor for changes to convert_hosts.sh.