216.73.217.22

UNC6201

· Published 18/02/2026 17:40 · Modified 18/02/2026 17:40 · Source: AlienVault

Essential information

Confidence
100/100
Published
18/02/2026 17:40
Modified
18/02/2026 17:40
Updated at
18/02/2026 17:40
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
2 reports, 26 attack patterns (mitre), 3 malware, 9 indicators, 1 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (2)

Attack patterns (MITRE) (26)

  • T1133 uses
    External Remote Services
  • T1571 uses
    Non-Standard Port
  • T1105 uses
    Ingress Tool Transfer
  • T1078 uses
    Valid Accounts
  • T1083 uses
    File and Directory Discovery
  • T1569.002 uses
    Service Execution
  • T1068 uses
    Exploitation for Privilege Escalation
  • T1132 uses
    Data Encoding
  • T1543.002 uses
    Systemd Service
  • T1573 uses
    Encrypted Channel
  • T1505.003 uses
    Web Shell
  • T1018 uses
    Remote System Discovery
  • T1016 uses
    System Network Configuration Discovery
  • T1027 uses
    Obfuscated Files or Information
  • T1021.001 uses
    Remote Desktop Protocol
  • T1057 uses
    Process Discovery
  • T1053.003 uses
    Cron
  • T1055 uses
    Process Injection
  • T1095 uses
    Non-Application Layer Protocol
  • T1190 uses
    Exploit Public-Facing Application
  • T1071 uses
    Application Layer Protocol
  • T1021.002 uses
    SMB/Windows Admin Shares
  • T1021.004 uses
    SSH
  • T1021 uses
    Remote Services
  • T1082 uses
    System Information Discovery
  • T1053 uses
    Scheduled Task/Job

Malware (3)

  • BRICKSTORM uses
    Family
    Published 05/06/2026 18:07 · Modified 05/06/2026 18:07
  • SLAYSTYLE uses
    Family
    Published 19/02/2026 20:16 · Modified 19/02/2026 20:16
  • GRIMBOLT uses
    Family
    Published 19/02/2026 20:16 · Modified 19/02/2026 20:16

Indicators (9)

Vulnerabilities (CVE) (1)

CVE-2026-22769 KEV
10.0 Critical

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated …

Attack vector
NETWORK
Published
17/02/2026
Modified
22/02/2026
Analyzed