Loading threat actor…
UNC6201, also written UNC_6201, is a China-linked cyber-espionage threat cluster active since at least mid-2024. It targets enterprise edge appliances and virtualization infrastructure, including VPN concentrators, Dell RecoverPoint for Virtual Machines appliances, and VMware environments. Its operations emphasize long-term access through systems that lack conventional endpoint detection and response coverage. UNC6201 shares notable operational overlaps with UNC5221, publicly associated with Silk Typhoon, but the clusters are tracked separately and are not established aliases. UNC6201 exploited CVE-2026-22769, a hard-coded credential vulnerability in Dell RecoverPoint for Virtual Machines, as a zero-day from at least mid-2024. The actor abused embedded Apache Tomcat Manager credentials to deploy malicious WAR packages containing the SLAYSTYLE web shell, enabling root-level command execution. It used compromised appliances for lateral movement, persistence, and deployment of BRICKSTORM and GRIMBOLT backdoors. The initial entry vector in the investigated RecoverPoint intrusions was not confirmed, although the cluster is independently known to target edge appliances for initial access. In September 2025, UNC6201 was observed replacing older BRICKSTORM implants with GRIMBOLT, a C# backdoor providing remote shell access. GRIMBOLT uses native ahead-of-time compilation and UPX packing to complicate static analysis. The actor establishes boot-time persistence by modifying legitimate startup scripts. Within VMware environments, it creates and subsequently removes temporary virtual network interfaces, termed Ghost NICs, to facilitate stealthy pivoting into internal networks and SaaS infrastructure. On compromised vCenter appliances, it has implemented iptables-based Single Packet Authorization to conceal access to command-and-control services. UNC6201 also captures valid credentials from compromised edge appliances and uses them to access VMware infrastructure. Investigations of its activity in 2025 recorded an average undetected dwell time of 393 days. The cluster has additionally used AI systems for vulnerability research and exploit development, and automated premium LLM account registration and cancellation to obtain repeated access to free credits.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
13 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Described as a Chinese state-sponsored activity cluster exploiting Dell RecoverPoint for Virtual Machines since mid-2024 to create hidden network interfaces on VMware ESXi servers and deploy malware. It is background context, not an identified exploiter of the newly disclosed DSU or CSM vulnerabilities. The content reports overlaps with Silk Typhoon but does not establish that they are aliases.
A suspected Chinese cyber-espionage cluster associated with exploitation of a hardcoded-credentials vulnerability in Dell RecoverPoint. Researchers reported overlaps with Silk Typhoon, but the content does not establish that the two names identify the same actor.
Cluster lié à la Chine maintenant des accès persistants de très longue durée sur des couches d’infrastructure peu visibles, notamment serveurs de virtualisation et équipements de bordure, à des fins d’espionnage.
Referenced as a PRC-linked threat cluster that exploited Dell RecoverPoint for Virtual Machines zero-day CVE-2026-22769 and delivered BRICKSTORM, GRIMBOLT, and the SLAYSTYLE webshell.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.