Dell RecoverPoint Persistence via Script Modification

Ethan Andrews@eandrews

•updated Feb 18, 2026•6•0•68

This detection identifies modifications to the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This script is executed at boot time and was observed being modified by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.