Security researchers from Mandiant and Google Threat Intelligence Group (GTIG) have revealed that a suspected China-linked threat actor UNC6201 has conducted a long-running espionage campaign since mid-2024 exploiting a critical hardcoded-credential vulnerability (CVE-2026-22769, CVSS 10/10) in Dell RecoverPoint for Virtual Machines, allowing unauthenticated attackers to access an exposed Apache Tomcat Manager instance, deploy a SLAYSTYLE web shell, and obtain root-level persistence across affected environments. Following initial compromise, the group deployed BRICKSTORM and later transitioned to GRIMBOLT, a more advanced C# backdoor compiled using native ahead-of-time techniques to improve stealth, evade forensic detection, and maintain long-term access while leveraging shared command-and-control (C2) infrastructure. UNC6201 demonstrated advanced post-exploitation tradecraft within virtualized environments, including the creation of temporary “Ghost NIC” interfaces on VMware ESXi systems to pivot between compromised virtual machines, internal networks, and SaaS resources, as well as the use of iptables-based traffic manipulation to selectively permit covert C2 communication. The campaign has primarily targeted North American organizations and focuses on edge and virtualization appliances that typically lack EDR coverage, enabling extended dwell time and persistent espionage activity, with fewer than a dozen confirmed victims but likely broader undiscovered impact. Researchers also identified overlaps with suspected cyber espionage cluster UNC5221 and BRICKSTORM activity linked by CrowdStrike to Warp Panda, highlighting a broader ecosystem of virtualization-focused threat operations, while the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) addition of the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog underscores the urgency for organizations to patch affected versions, apply network segmentation, and proactively hunt for BRICKSTORM and GRIMBOLT indicators.