A zero-day vulnerability in Dell’s RecoverPoint for Virtual Machines product has been exploited by a China-linked cyberespionage group since at least mid-2024, Google’s Threat Intelligence Group (GTIG) and Mandiant reported on Tuesday. Exploitation of the vulnerability identified as CVE-2026-22769 has been attributed by GTIG and Mandiant to a threat actor tracked as UNC6201. The hackers exploited the flaw for lateral movement, persistence, and malware deployment. Dell RecoverPoint for Virtual Machines, part of the vendor’s data protection offering, provides resilience and disaster recovery functionality for VMware VMs. According to Dell’s advisory for CVE-2026-22769, the vulnerability is a hardcoded credential issue affecting RecoverPoint for Virtual Machines versions prior to 6.0.3.1…