GRIMBOLT
GRIMBOLT is a backdoor used by the suspected PRC-/China-nexus threat cluster UNC6201 in intrusions exploiting CVE-2026-22769, a critical hardcoded-credential vulnerability in Dell RecoverPoint for Virtual Machines. Reporting states UNC6201 used the flaw since at least mid-2024 to compromise Dell RecoverPoint appliances, move laterally, maintain persistence, and deploy SLAYSTYLE, BRICKSTORM, and later GRIMBOLT. Investigators observed older BRICKSTORM binaries being replaced with GRIMBOLT in September 2025.
GRIMBOLT is described as a C#-written foothold or persistent backdoor compiled using Native Ahead-of-Time (AOT) compilation and packed with UPX, which makes reverse engineering and static analysis more difficult by removing typical .NET/Common Intermediate Language metadata. It provides remote shell / remote command execution capability and uses the same command-and-control infrastructure previously associated with BRICKSTORM. Multiple reports state its command-and-control uses WebSocket communications; one reported endpoint is wss://149.248.11.71/rest/apisession, with associated IP 149.248.11.71.
The malware was deployed post-exploitation on compromised Dell RecoverPoint for Virtual Machines appliances and in some cases was associated with follow-on compromise of VMware virtual infrastructure. UNC6201 also maintained long-term access inside targeted networks and used related stealth techniques in the broader campaign, including temporary "Ghost NICs" on virtual machines to pivot while reducing defender visibility, and persistence via modification of the legitimate script /home/kos/kbox/src/installation/distribution/convert_hosts.sh so malware would execute via rc.local at boot. The campaign targeted backup, recovery, and VMware-related infrastructure, including organizations in North America.
High-confidence indicators directly mentioned in the content for GRIMBOLT include the WebSocket C2 endpoint wss://149.248.11.71/rest/apisession, IP 149.248.11.71, and sample hashes 24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c and dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591. Detection content referenced in reporting includes YARA rules G_APT_BackdoorToehold_GRIMBOLT_1 and G_Hunting_BackdoorToehold_GRIMBOLT_1.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
UNC6201 (suspected China-nexus) exploited CVE-2026-22769 to compromise Dell RecoverPoint for VMs appliances, deploying the SLAYSTYLE web shell, BRICKSTORM backdoor, and GRIMBOLT. | UNC6201 (suspected China-nexus) exploited CVE-2026-22769 to compromise Dell RecoverPoint for VMs appliances, deploying the SLAYSTYLE web shell, BRICKSTORM backdoor, and GRIMBOLT, a C#-based backdoor with native AOT compilation to complicate detection.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A significant development in this campaign is the threat actor’s transition from the BRICKSTORM backdoor to a new malware family dubbed GRIMBOLT.
By September, however, the attackers had replaced Brickstorm with Grimbolt, a more advanced malware that’s harder to detect... replacing older Brickstorm binaries with the new backdoor that’s more difficult to reverse engineer.
"Carmakal said they observed the hackers using a novel backdoor they named GRIMBOLT."
By September, however, the attackers had replaced Brickstorm with Grimbolt, a more advanced malware that’s harder to detect... replacing older Brickstorm binaries with the new backdoor that’s more difficult to reverse engineer.
GTIG said the bug, tracked as CVE-2026-22769, was used to deploy a newer version of the Brickstorm backdoor malware that GTIG now calls Grimbolt and uses “ghost NICs” on virtual machines to avoid defenders.
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesAn unauthenticated remote attacker who leverages the hardcoded credential can gain root-level access and establish persistent control
Mandiant and Google Threat Intelligence Group (GTIG) have identified the zero-day exploitation of a high-risk vulnerability in Dell RecoverPoint for Virtual Machines, tracked as CVE-2026-22769... UNC6201... has exploited this flaw since at least mid-2024
Execution
2 techniques"...the malware enables command execution, file transfer, and lateral movement..." and "...upload a malicious WAR file... and then execute commands as root on the appliance."
GRIMBOLT is a C#-written foothold backdoor... It provides a remote shell capability...
Persistence
8 techniquesTo maintain persistence, UNC6201 modifies the legitimate convert_hosts.sh script, ensuring the backdoor executes automatically at system boot via rc.local.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local .
An unauthenticated remote attacker who leverages the hardcoded credential can gain root-level access and establish persistent control
the bug, tracked as CVE-2026-22769, was used to deploy a newer version of the Brickstorm backdoor malware that GTIG now calls Grimbolt
UNC6201 (suspected China-nexus) exploited CVE-2026-22769 to compromise Dell RecoverPoint for VMs appliances, deploying the SLAYSTYLE web shell, BRICKSTORM backdoor, and GRIMBOLT, a C#-based backdoor with native AOT compilation to complicate detection.
execute commands as root on the appliance to drop the BRICKSTORM backdoor and its newer version dubbed GRIMBOLT
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
Privilege Escalation
7 techniquesTo maintain persistence, UNC6201 modifies the legitimate convert_hosts.sh script, ensuring the backdoor executes automatically at system boot via rc.local.
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local .
"executing commands as root"
An unauthenticated remote attacker who leverages the hardcoded credential can gain root-level access and establish persistent control
execute commands as root on the appliance to drop the BRICKSTORM backdoor and its newer version dubbed GRIMBOLT
UNC6201 established BRICKSTORM and GRIMBOLT persistence on the Dell RecoverPoint for Virtual Machines by modifying a legitimate shell script named convert_hosts.sh to include the path to the backdoor. This shell script is executed by the appliance at boot time via rc.local.
Stealth
3 techniquesGRIMBOLT is written in C# and compiled using Native Ahead-of-Time (AOT) compilation... removing Common Intermediate Language (CIL) metadata that security tools typically scan. The malware is further packed with UPX to complicate static analysis.
An unauthenticated remote attacker who leverages the hardcoded credential can gain root-level access and establish persistent control
uses “ghost NICs” on virtual machines to avoid defenders... created virtual NICs on virtual machines to perform malicious activities, and then deleted those NICs.
Credential Access
1 techniqueUNC6201 exploited a hardcoded administrator password in Apache Tomcat that was used by the Dell backup gear.
Discovery
1 techniqueThe threat actor created virtual NICs on virtual machines to perform malicious activities, and then deleted those NICs.
Lateral Movement
3 techniquesthese two additional IP addresses both had the same 3389 (RDP) port open as well
“UNC6201 ... has exploited this flaw since at least mid-2024 to move laterally, maintain persistent access...” and “contain a hardcoded credential vulnerability... unauthenticated remote attacker... leading to unauthorized access...”
Mandiant identified a campaign featuring the replacement of older BRICKSTORM binaries with GRIMBOLT in September 2025.
Command and Control
7 techniques"they noticed the systems were communicating with hacker-controlled command and control servers associated with BRICKSTORM and GRIMBOLT backdoors"
"GRIMBOLT established WebSocket-based C2 communications: 149.248.11.71 wss://149.248.11.71/rest/apisession"
The attackers employ a stealthy traffic management technique known as Single Packet Authorization (SPA) using iptables... When this magic packet is detected, the source IP address is added to an allowlist.
suspected China-nexus threat cluster UNC6201 has exploited this flaw since at least mid-2024 to move laterally, maintain persistent access, and deploy malware including Slaystyle, Brickstorm, and a novel backdoor tracked as Grimbolt.
...drop the BRICKSTORM backdoor and its newer version dubbed GRIMBOLT... While GRIMBOLT also provides a remote shell capability...
"iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-ports 10443"
This technique effectively hides the command and control (C2) channel from casual observation and automated scanning.
Other
1 techniqueIOCs tracked for this family
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A C#-based backdoor with native AOT compilation used by UNC6201 to complicate detection on compromised Dell RecoverPoint for VMs appliances.
VMware 백업·복구 인프라 침해 후 배포된 백도어로, 복구 체계 무력화와 지속적 접근에 사용된다.
Backdoor deployed against VMware backup and recovery infrastructure to neutralize recovery systems after exploitation of Dell RecoverPoint for Virtual Machines.
Novel backdoor used in Dell RecoverPoint intrusions to maintain persistent access (further capabilities not described in the content).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.