Threat Brief - 2026-02-18
Threat Brief — Tuesday, February 18, 2026
Executive Summary
Google Mandiant reveals Dell RecoverPoint for VMs zero-day (CVE-2026-22769) has been exploited by China-nexus UNC6201 since mid-2024. CISA adds four actively exploited CVEs to KEV including an 18-year-old Windows flaw now dropping worms. Check Point demonstrates AI assistants (Copilot, Grok) can be weaponized as stealthy C2 proxies. Unit 42 documents expanded Ivanti EPMM exploitation with web shells and botnet deployment.
1. CVE-2026-22769 — Dell RecoverPoint Zero-Day Exploited Since Mid-2024
What’s New
Google Mandiant and GTIG reveal a CVSS 10.0 zero-day in Dell RecoverPoint for Virtual Machines has been exploited by China-nexus threat cluster UNC6201 since mid-2024. Dell released patches today.
Technical Details
| Field | Value |
|---|---|
| CVE | CVE-2026-22769 |
| CVSS | 10.0 (Critical) |
| Affected | RecoverPoint for VMs < 6.0.3.1 HF1 |
| Type | Hard-coded credentials |
| Exploitation | Since mid-2024 |
| Attribution | UNC6201 (China-nexus, overlaps UNC5221) |
Root Cause: Hard-coded “admin” credentials for Apache Tomcat Manager allow unauthenticated attackers to upload web shells via /manager/text/deploy endpoint and execute commands as root.
Post-Exploitation:
- SLAYSTYLE web shell deployment
- BRICKSTORM backdoor (original)
- GRIMBOLT backdoor (newer, C# native AOT compiled for evasion)
TTPs
| Tactic | Technique | Observable |
|---|---|---|
| Initial Access | T1190 - Exploit Public-Facing Application | HTTP to /manager/text/deploy |
| Execution | T1059 - Command and Scripting Interpreter | Commands via web shell |
| Persistence | T1505.003 - Web Shell | SLAYSTYLE deployed to Tomcat |
| Defense Evasion | T1027.009 - Embedded Payloads | GRIMBOLT uses native AOT compilation |
Detection Opportunities
// Tomcat Manager deploy requests
WebServerLogs
| where uri_path contains "/manager/text/deploy"
| where http_method == "PUT"
// RecoverPoint spawning shells
ProcessEvents
| where ParentProcessName contains "java" or ParentProcessName contains "tomcat"
| where ProcessName in ("sh", "bash", "cmd.exe", "powershell.exe")Log Sources
- Web server access logs (Tomcat)
- EDR process telemetry
- Network traffic to Dell RecoverPoint appliances
Detection Coverage
| Source | Status |
|---|---|
| Sigma | ❌ No specific rules |
| Splunk ESCU | ❌ No specific rules |
| Elastic | ❌ No specific rules |
Gap: Custom detection needed for RecoverPoint-specific exploitation.
Sources
- Google Mandiant — Published Feb 18, 2026
- The Hacker News — Published Feb 18, 2026
- Dell Advisory DSA-2026-079 — Published Feb 18, 2026
2. CISA Adds 4 Actively Exploited Vulnerabilities to KEV
What’s New
CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog, including an 18-year-old Windows flaw now delivering worms.
Technical Details
| CVE | Product | CVSS | Notes |
|---|---|---|---|
| CVE-2026-2441 | Chrome CSS | 8.8 | Previously covered Feb 16 |
| CVE-2024-7694 | TeamT5 ThreatSonar | 7.2 | Arbitrary file upload → RCE |
| CVE-2020-7796 | Zimbra Collaboration | 9.8 | SSRF, ~400 IPs exploiting |
| CVE-2008-0015 | Windows Video ActiveX | 8.8 | 18-year-old vuln → Dogkild worm |
CVE-2008-0015 Exploitation: Microsoft confirms this ancient vulnerability is now delivering Dogkild worm which:
- Propagates via removable drives
- Terminates security processes
- Modifies Hosts file to block security vendor domains
TTPs
| Tactic | Technique | Observable |
|---|---|---|
| Initial Access | T1189 - Drive-by Compromise | Malicious ActiveX page |
| Defense Evasion | T1562.001 - Disable Security Tools | Process termination |
| Defense Evasion | T1565.001 - Stored Data Manipulation | Hosts file modification |
| Lateral Movement | T1091 - Replication Through Removable Media | USB propagation |
Detection Opportunities
// Hosts file modification blocking security domains
FileModificationEvents
| where FilePath endswith "\\drivers\\etc\\hosts"
| where FileContent contains_any ("avast", "kaspersky", "mcafee", "symantec", "crowdstrike")
// Zimbra SSRF exploitation
WebServerLogs
| where uri_path contains "/zimbra"
| where uri_query contains "169.254" or uri_query contains "metadata"Log Sources
- Windows Security Event Log
- File integrity monitoring
- Web server/WAF logs (Zimbra)
Detection Coverage
| Source | Status |
|---|---|
| Sigma | ✅ Hosts file modification rules exist |
| Splunk ESCU | ⚠️ Legacy rules may exist |
| Elastic | ✅ Host file tampering detection |
Sources
- CISA KEV Catalog — Published Feb 18, 2026
- The Hacker News — Published Feb 18, 2026
3. AI Assistants Weaponized as C2 Proxies
What’s New
Check Point Research demonstrates Microsoft Copilot and xAI Grok can be abused as bidirectional C2 channels, blending malicious traffic with legitimate enterprise AI usage.
Technical Details
| Field | Value |
|---|---|
| Affected | Microsoft Copilot, xAI Grok |
| Technique | AI as C2 proxy |
| Requirements | No API key, no account needed |
| Bypass | Traffic goes to trusted AI service domains |
How It Works:
- Malware crafts prompts causing AI to fetch attacker URLs
- AI retrieves commands disguised as web content
- Malware parses AI response to extract commands
- Exfiltration via similar prompt-fetch-summarize chains
TTPs
| Tactic | Technique | Observable |
|---|---|---|
| Command and Control | T1102 - Web Service | AI service as C2 relay |
| Command and Control | T1071.001 - Web Protocols | HTTPS to AI domains |
| Exfiltration | T1041 - Exfiltration Over C2 | Data embedded in AI prompts |
Detection Opportunities
// AI service followed by command execution
ProcessEvents
| where ParentProcessName in ("chrome.exe", "msedge.exe", "firefox.exe")
| where ProcessName in ("cmd.exe", "powershell.exe")
| where PreviousNetworkConnection contains_any ("copilot.microsoft.com", "grok.x.ai")
// High-frequency AI access patterns
NetworkEvents
| where dest_domain in ("copilot.microsoft.com", "grok.x.ai")
| summarize RequestCount=count() by src_ip, bin(TimeGenerated, 5m)
| where RequestCount > 20Log Sources
- Proxy/firewall logs
- EDR process + network correlation
- UEBA for anomalous AI usage patterns
Detection Coverage
| Source | Status |
|---|---|
| Sigma | ❌ No rules exist |
| Splunk ESCU | ❌ No rules exist |
| Elastic | ❌ No rules exist |
Gap: Behavioral/UEBA approach required. Static signatures won’t catch this.
Sources
- Check Point Research — Published Feb 17, 2026
- The Hacker News — Published Feb 18, 2026
4. Ivanti EPMM Exploitation Expands — New TTPs (Update)
What’s New
Unit 42 documents expanded exploitation of CVE-2026-1281/CVE-2026-1340 with web shells, Nezha botnet deployment, and new sector targeting.
See Threat Brief - 2026-02-14 for initial coverage
Technical Details
| Field | Value |
|---|---|
| CVEs | CVE-2026-1281, CVE-2026-1340 |
| New TTPs | Web shells (401.jsp, 403.jsp), Nezha botnet |
| Exposure | ~4,400 EPMM instances |
| Targets | US, Germany, Australia, Canada |
Sectors Targeted:
- State and local government
- Healthcare
- Manufacturing
- Professional and legal services
TTPs
| Tactic | Technique | Observable |
|---|---|---|
| Persistence | T1505.003 - Web Shell | JSP files in /mi/tomcat/webapps/mifs/ |
| Command and Control | T1219 - Remote Access Software | Nezha monitoring agent |
| Execution | T1059.004 - Unix Shell | Reverse shell payloads |
Detection Opportunities
// JSP web shells in EPMM
FileCreationEvents
| where FilePath contains "/mi/tomcat/webapps/mifs/"
| where FileName endswith ".jsp"
// Ivanti EPMM exploitation patterns (Unit 42 XQL)
// Check logs for /mifs/c/(app|aft)store/fob with gPath parameterLog Sources
- EPMM/Tomcat access logs
- File integrity monitoring
- Cortex XDR/XSIAM (XQL queries available)
Detection Coverage
| Source | Status |
|---|---|
| Sigma | ⚠️ Generic web shell rules |
| Splunk ESCU | ❌ No Ivanti-specific rules |
| Elastic | ⚠️ Generic JSP upload rules |
Sources
Priority Actions
| Priority | Threat | Action |
|---|---|---|
| 🔴 Critical | Dell RecoverPoint CVE-2026-22769 | Patch to 6.0.3.1 HF1 immediately; hunt for SLAYSTYLE/GRIMBOLT |
| 🔴 Critical | Ivanti EPMM | Check for JSP files in /mi/tomcat/webapps/mifs/; patch if not done |
| 🟠 High | CVE-2008-0015 (Dogkild) | Monitor for Hosts file modifications blocking security domains |
| 🟡 Medium | AI C2 Proxy | Establish behavioral baselines for AI service usage |
Detection Gap Summary
| Threat | Sigma | Splunk ESCU | Elastic | Action |
|---|---|---|---|---|
| Dell RecoverPoint | ❌ | ❌ | ❌ | Build custom Tomcat Manager detection |
| AI C2 Proxy | ❌ | ❌ | ❌ | UEBA/behavioral analysis required |
| CVE-2008-0015/Dogkild | ✅ | ⚠️ | ✅ | Verify legacy rules active |
| Ivanti EPMM web shells | ⚠️ | ❌ | ⚠️ | Add Ivanti-specific paths |
Generated by Shade — ajking.io