INTEL_REPORT
Mandiant / Google Threat Intelligence Blog · published 2/17/2026, 2:00:00 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day Written by: Peter Ukhanov, Daniel Sislo, Nick Harbour, John Scarbrough, Fernando Tomlinson, Jr., Rich Reece Introduction Mandiant and Google Threat Intelligence Group (GTIG) have identified the zero-day exploitation of a high-risk vulnerability in Dell RecoverPoint for Virtual Machines , tracked as CVE-2026-22769 , with a CVSSv3.1 score of 10.0 . Analysis of incident response en…
https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day
sha256:a9d0ebba1bb915f76cb3ca68e69c0c86246e5b97b79909beab8d05d2ee161072
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| 24a11a26a2586f4fba7bfe89df2e21a0809ad85069e442da98c37c4add369a0c |
| Open → |
| sha256 | dfb37247d12351ef9708cb6631ce2d7017897503657c6b882a711c0da8a9a591 | Open → |
| sha256 | 92fb4ad6dee9362d0596fda7bbcfe1ba353f812ea801d1870e37bfc6376e624a | Open → |
| sha256 | aa688682d44f0c6b0ed7f30b981a609100107f2d414a3a6e5808671b112d1878 | Open → |
| sha256 | 2388ed7aee0b6b392778e8f9e98871c06499f476c9e7eae6ca0916f827fe65df | Open → |
| sha256 | 320a0b5d4900697e125cebb5ff03dee7368f8f087db1c1570b0b62f5a986d759 | Open → |
| sha256 | 90b760ed1d0dcb3ef0f2b6d6195c9d852bcb65eca293578982a8c4b64f51b035 | Open → |
| sha256 | 45313a6745803a7f57ff35f5397fdf117eaec008a76417e6e2ac8a6280f7d830 | Open → |