Mastodawn

CVE-2026-22769 (CVSS 10.0) in Dell RecoverPoint for VMs is under confirmed exploitation.

Attribution: UNC6201 (linked to Silk Typhoon)
Malware: BRICKSTORM (evolving) → GRIMBOLT
Vector: Hard-coded credentials
Impact Layer: VMware-integrated DR appliances

This is a high-leverage target:
- Elevated privileges
- Direct integration with hypervisors & storage
- Influence over replicated datasets
- Potential long-term espionage dwell time

CISA has mandated immediate patching for federal agencies.

Key takeaway: Recovery infrastructure is now an active battlefield.
How are you validating integrity of replicated VM copies?
Comment below.

Source: https://therecord.media/fed-agencies-ordered-to-patch-dell-bug-after-exploitation-warning

Follow TechNadu for threat intelligence updates.
Share within your security teams.
#Infosec #ThreatIntelligence #ZeroDay #CISAAlert #VMwareSecurity #CyberEspionage #BlueTeam #RedTeam #APT #SecurityOperations #DigitalForensics

The DefendOps Diaries Sep 24, 2025

Brickstorm malware is on the move—exploiting stealth by targeting overlooked systems like VMware and cloud setups to clone VMs and swipe credentials. Is your network hiding a blind spot?

https://thedefendopsdiaries.com/brickstorm-malware-a-stealthy-cross-platform-threat-targeting-modern-enterprise-infrastructure/

#brickstorm
#malwareanalysis
#cyberthreats
#vmwaresecurity
#cloudsecurity