UNC6201

UNC6201 is a suspected PRC-nexus threat cluster involved in cyber espionage activity. Reporting attributes to UNC6201 exploitation of the Dell RecoverPoint for Virtual Machines zero-day CVE-2026-22769 since at least mid-2024. In these intrusions, the actor used the flaw to compromise Dell RecoverPoint appliances, move laterally, maintain persistence, and in some cases pivot into VMware virtual infrastructure. Observed malware associated with UNC6201 includes the SLAYSTYLE web shell, the BRICKSTORM backdoor, and GRIMBOLT, a novel C# backdoor compiled with native ahead-of-time compilation and packed with UPX. Mandiant observed a September 2025 shift in some cases from BRICKSTORM to GRIMBOLT, with shared command-and-control infrastructure between the two malware families. UNC6201 has also been reported compromising edge devices that do not support endpoint security products, deploying BRICKSTORM for long-term access, capturing valid credentials from compromised appliances, and using those credentials to access victims' VMware environments. Mandiant reported average dwell time of 393 days in numerous 2025 incidents involving this activity. The actor is described as targeting edge and core network devices such as VPNs and routers, which typically lack standard EDR telemetry. Tradecraft directly described in the reporting includes modifying the legitimate convert_hosts.sh script for boot persistence via rc.local on Dell RecoverPoint appliances; deploying malicious WAR files through Apache Tomcat Manager using hard-coded credentials exposed in tomcat-users.xml; creating temporary "Ghost NICs" on ESXi virtual machines for stealthy pivoting into internal and SaaS environments; and using iptables-based Single Packet Authorization on compromised vCenter appliances to conceal command-and-control access. UNC6201 has also been observed using publicly hosted Python scripts to automate premium LLM account registration, CAPTCHA bypass, SMS verification, activation, and immediate cancellation, and Google reported the cluster among PRC- and DPRK-linked groups using AI systems for vulnerability research and exploit development. Reporting notes notable overlaps between UNC6201 and UNC5221, the cluster publicly known as Silk Typhoon, but states they are not currently assessed as the same cluster.