A suspected China-linked hacking group has been exploiting a critical, previously unknown vulnerability in Dell Technologies data protection appliances, according to a new report from Google Threat Intelligence Group (GTIG) and Mandiant.

Researchers said the threat cluster known as UNC6201 used the zero-day to gain deep access to victim networks, maintain long-term persistence, and deploy multiple malware families in addition to a newly identified backdoor dubbed Grimbolt.

While the threat has been active since at least mid-2024, Dell has since released patches and urged users to follow its official security advisory.

According to the report, attackers exploited hard-coded default administrator credentials in the appliance’s Apache Tomcat Manager configuration file. By authenticating as “admin,” they were able to upload a malicious WAR file, installing an SLAYSTYLE web shell, and executing commands as root.

The earliest confirmed exploitation was tracked to mid-2024, however the initial access vector remains unclear. Researchers pointed out that the threat cluster has previously targeted edge devices such as VPN appliances for footholds.

Shift from Brickstorm malware to Grimbolt

In September 2025, the investigators observed attackers replacing older Brickstorm malware with Grimbolt across compromised systems, marking a shift in tradecraft.

Grimbolt was written in C# and compiled using native ahead-of-time compilation – a method known since 2022 that converts code directly into machine-native binaries. This approach improves performance on resource-constrained appliances, complicating static analysis.

Researchers said it remains unclear whether the malware upgrade was planned or it was a reaction to ongoing incident response efforts.

Beyond exploiting Dell appliances, UNC6201 was observed pivoting into VMware virtual infrastructure using previously undocumented techniques.

One tactic involved creating temporary “Ghost NICs” – additional network interfaces attached to existing virtual machines – enabling stealthy lateral movement into internal and software-as-a-service (SaaS) environments.

Detection and Google response guidance

The threat shares some similarities with another cluster, which has been publicly associated with the Chinese-associated Silk Typhoon group. However, Google Threat Intelligence Group said it does not currently assess the two clusters to be the same entity.

To address the issues, Mandiant provided detailed forensic guidance for defenders, highlighting Tomcat Manager audit logs, WAR file deployment artifacts, and modifications to boot scripts as high-value indicators of compromise. Indicators of compromise (IOCs) have also been published in a GTI Collection.

The findings follow earlier research into Brickstorm espionage campaigns and underscore the continued targeting of enterprise edge infrastructure by advanced threat actors. Security teams are urged to apply patches immediately and review systems for signs of compromise dating back to 2024.

In another recent report, the Google Threat Intelligence Group exposed that threat actors have been increasingly integrating AI into their attacks, a move that has bolstered their productivity in investigation, social engineering, and malware development.

Along with Google DeepMind, the company identified an increase in model extraction attempts, so-called “distillation attacks,” a method of intellectual property theft that violates Google’s terms of service.

For government-backed attackers, large language models (LLMs) have emerged as essential tools for technical research, targeting, and the rapid generation of nuanced phishing lures.