China-Linked Hackers Exploit Dell RecoverPoint Flaw

A China-linked hacking group has been exploiting a critical security flaw in Dell's RecoverPoint for Virtual Machines software since at least mid-2024, allowing unauthorized access to corporate backup systems and enabling long-term espionage, according to joint research from Google's Threat Intelligence Group and cybersecurity firm Mandiant.

The vulnerability, tracked as CVE-2026-22769 and rated at the highest severity level with a CVSS score of 10.0, stems from hardcoded credentials in the software. This default username and password setup permits an unauthenticated remote attacker to log in as an administrator, execute root-level commands, and gain full control over the affected system. Dell RecoverPoint for Virtual Machines is a data protection tool used by organizations to replicate and recover virtual machines in VMware environments, making it essential for business continuity during outages or disasters.

Mandiant identified the flaw during incident response investigations into compromised networks, where analysts observed the systems communicating with hacker-controlled servers. The group, designated UNC6201 and believed to have ties to the People's Republic of China, used...