Chinese Cyber-Espionage Group Exploits Critical 0-Day in Dell RecoverPoint

On February 17, 2026, Mandiant and the Google Threat Intelligence Group (GTIG) revealed that a newly identified China-linked cyber-espionage group, UNC6201, had been exploiting a zero-day vulnerability in Dell RecoverPoint for Virtual Machines since 2024.

The backup and disaster recovery solution is widely used by large enterprises to protect virtual environments.

Cybersecurity researchers identified a hard-coded password in the source code of certain versions of Dell RecoverPoint. The vulnerability was assigned the highest severity rating, with a CVSS score of 10.0.

By exploiting the flaw, UNC6201 obtained administrative access to targeted systems, enabling the deployment of malware. Some of the tools used were previously known, such as Slaystyle and Brickstorm, while others were newly identified, including a Trojan dubbed Grimbolt.

The group installed malicious tools to maintain stealthy and persistent access to compromised machines.

The attackers also created fake network interfaces (“Ghost NICs”) on VMware ESXi servers to move laterally without detection. In addition, they modified legitimate scripts to discreetly ensure persistence.

Dell Technologies has released a patch addressing the vulnerability and is urging customers to apply it as soon as possible. According to the company, active exploitation cases remain “limited” at this stage.

Mandiant and GTIG also identified similarities between UNC6201 and the group known as Silk Typhoon, which has been involved in several large-scale cyber-espionage campaigns attributed to Beijing. However, researchers have refrained from formally linking the two groups due to insufficient evidence.