SLAYSTYLE
SLAYSTYLE is a web shell targeting Apache Tomcat servers, implemented as a Java Servlet Filter. In observed intrusions, it was deployed as a malicious WAR file via the Apache Tomcat Manager /manager/text/deploy endpoint after attackers authenticated with hard-coded default admin credentials on Dell RecoverPoint for Virtual Machines appliances affected by CVE-2026-22769. Multiple reports state that successful deployment of SLAYSTYLE granted root-level command execution on the compromised appliance. Mandiant and Google Threat Intelligence Group attributed this activity to UNC6201, a suspected PRC-nexus threat cluster, which has exploited the vulnerability since at least mid-2024 for lateral movement, persistence, and follow-on malware deployment. SLAYSTYLE was observed alongside BRICKSTORM and the newer GRIMBOLT backdoor, and was also used on compromised VMware vCenter appliances to execute iptables commands implementing Single Packet Authorization by monitoring port 443 for a specific hex string, temporarily allowlisting source IPs, and redirecting approved traffic to port 10443. High-confidence forensic artifacts mentioned in the reporting include suspicious requests to /manager using the username admin, WAR deployment activity such as PUT /manager/text/deploy?path=/slaystyle&update=true, Tomcat deployment artifacts under /var/lib/tomcat9 and /var/cache/tomcat9/Catalina, relevant logs under /var/log/tomcat9/ and /home/kos/auditlog/fapi_cl_audit_log.log, and a SLAYSTYLE-related file default_jsp.java with SHA-256 92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a. Detection content referenced in the source material includes the YARA rule G_APT_BackdoorWebshell_SLAYSTYLE_4.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
These requests were directed to the installed Apache Tomcat Manager, used to deploy various components of the Dell RecoverPoint software, and resulted in the deployment of a malicious WAR file containing a SLAYSTYLE web shell.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These requests were directed to the installed Apache Tomcat Manager, used to deploy various components of the Dell RecoverPoint software, and resulted in the deployment of a malicious WAR file containing a SLAYSTYLE web shell.
SLAYSTYLE is a web shell targeting Apache Tomcat servers, implemented as a Java Servlet Filter.
SLAYSTYLE is a web shell targeting Apache Tomcat servers, implemented as a Java Servlet Filter.
SLAYSTYLE is a web shell targeting Apache Tomcat servers, implemented as a Java Servlet Filter.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
After analyzing various configuration files belonging to Tomcat Manager, we identified a set of hard-coded default credentials for the admin user in /home/kos/tomcat9/tomcat-users.xml. Using these credentials, a threat actor could authenticate to the Dell RecoverPoint Tomcat Manager
Mandiant and Google Threat Intelligence Group (GTIG) have identified the zero-day exploitation of a high-risk vulnerability in Dell RecoverPoint for Virtual Machines, tracked as CVE-2026-22769... UNC6201... has exploited this flaw since at least mid-2024
Execution
4 techniques
Execution
An analysis of the compromised VMware vCenter appliances has also uncovered iptable commands executed by means of the web shell...
Using these credentials, a threat actor could authenticate to the Dell RecoverPoint Tomcat Manager, upload a malicious WAR file using the /manager/text/deploy endpoint, and then execute commands as root on the appliance.
Persistence
3 techniques
Persistence
After analyzing various configuration files belonging to Tomcat Manager, we identified a set of hard-coded default credentials for the admin user in /home/kos/tomcat9/tomcat-users.xml. Using these credentials, a threat actor could authenticate to the Dell RecoverPoint Tomcat Manager
Privilege Escalation
2 techniques
Privilege Escalation
After analyzing various configuration files belonging to Tomcat Manager, we identified a set of hard-coded default credentials for the admin user in /home/kos/tomcat9/tomcat-users.xml. Using these credentials, a threat actor could authenticate to the Dell RecoverPoint Tomcat Manager
Stealth
1 technique
Stealth
After analyzing various configuration files belonging to Tomcat Manager, we identified a set of hard-coded default credentials for the admin user in /home/kos/tomcat9/tomcat-users.xml. Using these credentials, a threat actor could authenticate to the Dell RecoverPoint Tomcat Manager
Lateral Movement
1 technique
Lateral Movement
Command and Control
3 techniques
Command and Control
Communicates with its C2 infrastructure over WebSockets, with some variants using DNS-over-HTTPS (DoH) to obscure C2 lookups from standard DNS monitoring
Other
2 techniques
Other
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Java Servlet Filter-based web shell for Apache Tomcat used for credential harvesting and passive backdoor access. Its implementation as a servlet filter makes it stealthier than typical uploaded web shells because defenders must inspect Tomcat application context or configuration rather than just the web root.
A web shell deployed on compromised Dell RecoverPoint for VMs appliances by UNC6201 after exploiting CVE-2026-22769.
Malware deployed post-exploitation in Dell RecoverPoint intrusions to support persistence and follow-on activity (exact functionality not detailed in the content).
Webshell used for remote command execution and persistence within compromised environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.