TL;DR

Chinese attackers have leveraged a critical hardcoded credential flaw in Dell's software since June 2024 to install stealthy network interfaces and maintain persistent backdoor access on infected machines.

What happened

China-linked hackers exploited a zero-day vulnerability related to hardcoded credentials in Dell RecoverPoint for Virtual Machines, deploying this exploit from mid-2024 onwards. The attack installs 'ghost NICs' which are invisible to regular scans, ensuring long-term undetected access to compromised systems.

Why it matters for ops

The use of zero-day exploits and stealthy network interfaces underscores the need for proactive security measures such as continuous monitoring, updated intrusion detection systems, and prompt response protocols. The attackers’ persistence highlights the evolving nature of cyber threats.

Action items

  • Review and update intrusion detection systems to recognize 'ghost NICs' and similar stealth tactics
  • Conduct a thorough audit of Dell RecoverPoint for Virtual Machines installations in your network
  • Implement strict credential management policies and monitor for anomalous access patterns

Source link

https://go.theregister.com/feed/www.theregister.com/2026/02/18/dell_0day_brickstorm_campaign/