A vulnerability was detected on Dell's computer. Chinese hackers were found.

A vulnerability was detected on Dell's computer. Chinese hackers were found to install malware down.

Software to help users of computers that are specific to each brand often has a variety of good features, but if they are vulnerable, they can cause unexpected problems.

According to a report by the website, Cyberpress has mentioned the detection of a vulnerability in the form of a vulnerability that occurs during development or Zero-Day of software installed with Dell's computer, Dell RecoverPoint for Virtual Machines, coded CVE-2026-22769. This vulnerability has a danger rating or CVSS of up to 10.0 or maximum danger. This vulnerability is caused by the default access code, or Default Credential is recorded as a Hardcoded constant within the Configuration of Apache Tomcat Manager, allowing hackers with password information. Access to the system at the highest attendant level or Root

The hacker exploits the vulnerability, logs into the Admin or Administrator level, and uploads a WAR file, a Java package containing commands that will allow it to upgrade access to the Root level to complete control of the machine. Sources have revealed that a Chinese hacker with the group name UNC6201 has been in use since 2024.

That group of hackers, after accessing the machine with a Root level through this procedure, will perform "Ghost NICs," a fake network interface, on the VMware server, and then smuggle it into the internal network and the cloud environment and embed the malware inside. In the past, hackers in the same group used BRICKSTORM and in September 2025. In the past, it was upgraded to GRIMBOLT with a feature to change code to machine language, allowing it to run quickly on the victim's machine with low power, as well as evade detection.

In addition, the malware has established persistence on the system or Persistence by embedding a file in / home / kos / kbox / src / installation / distribution / convert_hosts.sh to reboot the system. There is also a Web Shell tool called SLAYSTYLE embedded in / var / lib / tomcat9 / to use WAR files that hide dangerous code.

Dell, after learning of the news, was not complacent. The company issued a patch to upgrade the issue tool to version 6.0.3.1 HF1 to plug loopholes, as well as distribute scripts to help deal with suspected loopholes to hack into the system. Users are asked to update it immediately.

# dell # Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack