A suspected Chinese state-backed hacking group has been quietly exploiting a critical Dell security flaw in zero-day attacks that started in mid-2024.

Security researchers from Mandiant and the Google Threat Intelligence Group (GTIG) revealed today that the UNC6201 group exploited a maximum-severity hardcoded-credential vulnerability (tracked as CVE-2026-22769) in Dell RecoverPoint for Virtual Machines, a solution used for VMware virtual machine backup and recovery.

“Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability,” Dell explains in a security advisory published on Tuesday.

“This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.”

Once inside a victim’s network, UNC6201 deployed several malware payloads, including newly identified backdoor malware called Grimbolt. Written in C# and built using a relatively new compilation technique, this malware is designed to be faster and harder to analyze than its predecessor, a backdoor called Brickstorm.

While the researchers have observed the group swapping out Brickstorm for Grimbolt in September 2025, it remains unclear whether the switch was a planned upgrade or “a reaction to incident response efforts led by Mandiant and other industry partners.”

Targeting VMware ESXi servers

The attackers also used novel techniques to burrow deeper into victims’ virtualized infrastructure, including creating hidden network interfaces (so-called Ghost NICs) on VMware ESXi servers to move stealthily across victims’ networks.

“UNC6201 uses temporary virtual network ports (AKA “Ghost NICs”) to pivot from compromised VMs into internal or SaaS environments, a new technique that Mandiant has not observed before in their investigations,” Mandiant communications manager Mark Karayan told BleepingComputer.

“Consistent with the earlier BRICKSTORM campaign, UNC6201 continues to target appliances that typically lack traditional endpoint detection and response (EDR) agents to remain undetected for long periods.”

The researchers have found overlaps between UNC6201 and a separate Chinese threat cluster, UNC5221, known for exploiting Ivanti zero-days to target government agencies with custom Spawnant and Zipline malware and previously linked to the notorious Silk Typhoon Chinese state-backed threat group (although the two are not considered identical by GTIG).

GTIG added in September that UNC5221 hackers used Brickstorm (first documented by Google subsidiary Mandiant in April 2024) to gain long-term persistence on the networks of multiple U.S. organizations in the legal and technology sectors, while CrowdStrike has linked Brickstorm malware attacks targeting VMware vCenter servers of legal, technology, and manufacturing companies in the United States to a Chinese hacking group it tracks as Warp Panda.

To block ongoing CVE-2026-22769 attacks, Dell customers are advised to follow the remediation guidance shared in this security advisory.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Advertisement

Get the guide

Vulnerabilities with high to critical severity ratings affecting popular Visual Studio Code (VSCode) extensions collectively downloaded more than 128 million times could be exploited to steal local files and execute code remotely.

The security issues impact Code Runner (CVE-2025-65715), Markdown Preview Enhanced (CVE-2025-65716), Markdown Preview Enhanced (CVE-2025-65717), and Microsoft Live Preview (no identifier assigned).

Researchers at application security company Ox Security discovered the flaws and tried to disclose them since June 2025. However, the researchers say that no maintainer responded.

Remote code execution in IDE

VSCode extensions are add-ons that expand the functionality of Microsoft’s integrated development environment (IDE). They can add language support, debugging tools, themes, and other functionality or customization options.

They run with significant access to the local development environment, including files, terminals, and network resources.

Ox Security published reports for each of the discovered flaws and warned that keeping the vulnerable extensions could expose the corporate environment to lateral movement, data exfiltration, and system takeover.

An attacker exploiting the CVE-2025-65717 critical vulnerability in the Live Server extension (over 72 million downloads on VSCode) can steal local files by directing the target to a malicious webpage.

The CVE-2025-65715 vulnerability in the Code Runner VSCode extension, with 37 million downloads, allows remote code execution by changing the extension’s configuration file. This could be achieved through tricking the target into pasting or applying a maliciously configuration snippet in the global settings.json file.

Rated with a high-severity score of 8.8, CVE-2025-65716 affects the Markdown Preview Enhanced (8.5 million downloads) and can be leveraged to execute JavaScript via maliciously crafted Markdown file.

Ox Security researchers discovered a one-click XSS vulnerability in versions of Microsoft Live Preview before 0.4.16. It can be exploited to access sensitive files on a developer’s machine. The extension has more than 11 million downloads on VSCode.

The flaws in the extensions also apply to Cursor and Windsurf, which are AI-powered VSCode-compatible alternative IDEs.

Ox Security’s report highlights that the risks associated with a threat actor leveraging the issues include pivoting on the network and stealing sensitive details like API keys and configuration files.

Developers are advised to avoid running localhost servers unless necessary, opening untrusted HTML while they’re running, and applying untrusted configurations or pasting snippets into settings.json.

Also, it is advisable to remove unnecessary extensions and only install those from reputable publishers, while monitoring for unexpected setting changes.

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide

An internal research study at Meta dubbed “Project MYST” created in partnership with the University of Chicago, found that parental supervision and controls — such as time limits and restricted access — had little impact on kids’ compulsive use of social media. The study also found that kids who experienced stressful life events were more likely to lack the ability to moderate their social media use appropriately.

This was one of the notable claims revealed during testimony at the social media addiction trial that began last week in Los Angeles County Superior Court. The plaintiff in the lawsuit is identified by her initials “KGM” or her first name, “Kaley.” She, along with her mother and others joining the case, is accusing social media companies of creating “addictive and dangerous” products that led the young users to suffer anxiety, depression, body dysmorphia, eating disorders, self-harm, suicidal ideation, and more.

The case is now one of several landmark trials that will take place this year, which accuse social media companies of harming children. The results of these lawsuits will impact these companies’ approach to their younger users and could prompt regulators to take further action.

In this case, the plaintiff sued Meta, YouTube, ByteDance (TikTok), and Snap, but the latter two companies had settled their claims before the trial’s start.

In the jury trial now underway in LA, Kaley’s lawyer, Mark Lanier, brought up an internal study at Meta, which he said found evidence that Meta knew of, yet didn’t publicize, these specific harms.

In Project MYST, which stands for the Meta and Youth Social Emotional Trends survey, Meta’s research concluded that “parental and household factors have little association with teens’ reported levels of attentiveness to their social media use.”

Or, in other words, even when parents try to control their children’s social media use, either by using parental controls or even just household rules and supervision, it doesn’t impact whether or not the child will overuse social media or use it compulsively. The study was based on a survey of 1,000 teens and their parents about their social media use.

The study also noted that both parents and teens agreed on this front, saying “there is no association between either parental reports or teen reports of parental supervision, and teens’ survey measures of attentiveness or capability.”

If the study’s findings are accurate, that would mean that the use of things like the built-in parental controls in the Instagram app or the time limits on smartphones wouldn’t necessarily help teens become less inclined to overuse social media, the plaintiff’s lawyer argued. As the original complaint alleges, teens are being exploited by social media products, whose defects include algorithmic feeds designed to keep users scrolling, intermittent variable rewards that manipulate dopamine delivery, incessant notifications, deficient tools for parental controls, and more.

During his testimony, Instagram head Adam Mosseri claimed not to be familiar with Meta’s Project MYST, even though a document seemed to indicate he had given his approval to move forward with the study.

“We do a lot of research projects,” Mosseri said, after claiming he couldn’t remember anything specific about MYST beyond its name.

However, the plaintiff’s lawyer pointed to this study as an example of why social media companies should be held accountable for their alleged harms, not the parents. He noted that Kaley’s mother, for example, had tried to stop her daughter’s social media addiction and use, even taking her phone away at times.

What’s more, the study found that teens who had a greater number of adverse life experiences — like those dealing with alcoholic parents, harassment at school, or other issues — reported less attentiveness over their social media use. That means that kids facing trauma in their real lives were more at risk of addiction, the lawyer argued.

On the stand, Mosseri seemed to partially agree with this finding, saying, “There’s a variety of reasons this can be the case. One I’ve heard often is that people use Instagram as a way to escape from a more difficult reality.” Meta is careful not to label any sort of overuse as addiction; instead, Mosseri stated that the company uses the term “problematic use” to refer to someone “spending more time on Instagram than they feel good about.”

Lawyers for Meta, meanwhile, pushed the idea that the study was more narrowly focused on understanding if teens felt they were using social media too much, not whether or not they were actually addicted. They also generally aimed to put more of the responsibility on parents and the realities of life as the catalyst for kids like Kaley’s negative emotional states, not companies’ social media products.

For instance, Meta’s lawyers pointed to Kaley being a child of divorced parents, with an abusive father, and facing bullying at school.

How the jury will interpret the findings of studies like Project MYST and others, along with the testimonies from both sides, remains to be seen. Mosseri did note, however, that MYST’s findings had not been published publicly, and no warnings were ever issued to teens or parents as a result of the research.

Meta has been asked for comment.

A federal district court in Northern California ruled in favor of Cameo, a platform that allows users to get personalized video messages from celebrities, and ordered OpenAI to stop using “Cameo” in its products and features.

OpenAI was using the “Cameo” name for its AI-powered video generation app Sora 2. Users could use that feature to insert digital likenesses of themselves into AI-generated videos. In a ruling filed Saturday, the court said the name was similar enough to cause user confusion, and rejected OpenAI’s argument that “Cameo” was merely descriptive, finding that “it suggests rather than describes the feature.”

In November, the court granted a temporary restraining order to Cameo and stopped OpenAI from using the word. The AI company then renamed the feature to “Characters” after that order.

“We have spent nearly a decade building a brand that stands for talent-friendly interactions and genuine connection, and we like to say that ‘every Cameo is a commercial for the next one.” Cameo CEO Steven Galanis said in a statement.

“This ruling is a critical victory not just for our company, but for the integrity of our marketplace and the thousands of creators who trust the Cameo name. We will continue to vigorously defend our intellectual property against any platform that attempts to trade on the goodwill and recognition we have worked so hard to establish,” he noted.

“We disagree with the complaint’s assertion that anyone can claim exclusive ownership over the word ‘cameo,’ and we look forward to continuing to make our case,” an OpenAI spokesperson told Reuters in response to the ruling.

OpenAI has been involved in several intellectual property cases in recent months. Earlier this month, the company ditched “IO” branding around its upcoming hardware products, according to court documents obtained by WIRED. In November, digital library app OverDrive sued OpenAI over its use of “Sora” for its video generation app. The company is also in legal disputes with various artists, creatives, and media groups in various geographies over copyright violations.

A Spanish court has granted precautionary measures against NordVPN and ProtonVPN, ordering the two popular VPN providers to block 16 websites that facilitate piracy of football matches.

The restrictions will apply to a dynamic list of IP addresses in Spain, and there will be no opportunity for appeals. The measures were taken ‘inaudita parte’, meaning that the defendants weren’t called to participate in a hearing.

LaLiga – the country’s professional football organizer, and its broadcasting partner, Telefónica, are required to “preserve sufficient digital evidence of the unlawful transmission of the protected contents.”

LaLiga showed a strong stance against the piracy ecosystem in recent years, previously targeting Cloudflare, accusing the internet giant of facilitating illegal sports streaming.

The two organizations proved that the VPN providers fall under the EU Digital Services Regulation, and therefore have a duty to help prevent copyright infringement carried out through their infrastructure.

“The orders identify how VPN systems prove to be a suitable means, ‘highly effective and accessible to generate the possibility of access to content not accessible in certain geographic points,’ distorting the real geographic location of online access, and facilitating ‘access to websites that broadcast protected content illegally,’” reads LaLiga’s announcement.

“What is more, the orders highlight how the defendant companies acknowledge and even advertise that their system is excellent at evading restrictions.”

LaLiga characterized the ruling as unprecedented in Spain, aligning it with similar decisions in France, and celebrated that the liability of VPN providers for piracy is clearly recognized.

In response, ProtonVPN took to Twitter to question the decision, declaring a total lack of awareness of the proceedings and stating that they have not been formally notified.

“Any judicial order issued without proper notification to the affected parties, thereby denying them the opportunity to be heard, would be procedurally invalid under fundamental principles of due process, stated the VPN service provider.

“Spanish courts, like all courts operating under the rule of law, are bound by procedural safeguards that ensure parties are given a fair opportunity to present their case before any binding judgment is rendered.”

In a request for comments to BleepingComputer, NordVPN’s spokesperson Laura Tyrylyte stated that the company was not involved in any legal proceedings in Spain.

Tyrylyte stated that the process for blocking domains is ineffective in the fight against piracy as it does not address the root cause. Instead, hosting providers should be the target, since pirates can use subdomains to bypass the restrictions.

“Effective piracy control should focus on eliminating the source of the content, targeting hosting providers, cutting off financing for illegal operations, and increasing the availability of legitimate content.”

Through its representative, NordVPN said that the measures affect mostly reputable, paid VPN providers, while free services continue to operate largely unhindered.

“Free VPNs are often harder to regulate and, since users who seek to avoid paying for content are unlikely to pay for a VPN either, these services remain a loophole for pirates to bypass restrictions.”

Modern IT infrastructure moves faster than manual workflows can handle.

In this new Tines guide, learn how your team can reduce hidden manual delays, improve reliability through automated response, and build and scale intelligent workflows on top of tools you already use.

Get the guide