UNC6201
UNC6201 is a suspected PRC-nexus threat cluster associated with cyber espionage activity. Reporting describes notable overlaps with UNC5221, the cluster publicly known as Silk Typhoon, but the content states they are not currently assessed as the same cluster. UNC6201 has been observed targeting edge and core network devices and other appliances that typically lack standard endpoint security telemetry, including VPNs, routers, Dell RecoverPoint for Virtual Machines appliances, and VMware-related infrastructure. Mandiant investigated numerous 2025 incidents in which UNC6201 compromised edge devices that did not support endpoint security products, deployed the BRICKSTORM backdoor for long-term access, captured valid credentials from the appliance, and used that access to reach victims' VMware environments. The content states these intrusions remained undetected for an average of 393 days. UNC6201 has also been linked to active exploitation of Dell RecoverPoint for Virtual Machines zero-day CVE-2026-22769 since at least mid-2024. In those incidents, the actor used hard-coded Tomcat Manager credentials to authenticate and deploy a malicious WAR file via the /manager/text/deploy endpoint, installing the SLAYSTYLE web shell and deploying BRICKSTORM and the newer GRIMBOLT backdoor. Reported objectives included lateral movement, persistent access, and compromise of VMware backup and recovery infrastructure. Additional tradecraft directly mentioned in the content includes modifying convert_hosts.sh for persistence, creating temporary "Ghost NICs" on ESXi-hosted virtual machines for stealthy pivoting, and using iptables-based Single Packet Authorization to conceal command-and-control access. The malware and tooling directly associated with UNC6201 in the content are BRICKSTORM, SLAYSTYLE, and GRIMBOLT. GRIMBOLT is described as a C# backdoor compiled with native ahead-of-time compilation, in some reporting also packed with UPX, to complicate detection and reverse engineering. Separately, Google observed UNC6201 using AI systems for vulnerability research and exploit development. The content also states UNC6201 used publicly hosted or publicly available GitHub Python scripts to automate premium LLM account registration, CAPTCHA bypass, SMS verification, account activation, and immediate cancellation to cycle free credits. Known alias in the provided content: UNC6201.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
38 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PRC-linked cluster automating large-scale acquisition and churn of disposable premium AI accounts to sustain adversary LLM access.
Using AI systems for exploit development and vulnerability research.
Used automation to abuse LLM platforms by registering premium accounts, bypassing CAPTCHA and SMS verification, and cycling free credits.
Using AI models for vulnerability discovery and exploit development.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.