Unc6201 Tomcat Manager War Deployment

Daniel Jeremiah@daniyyell

•updated Feb 22, 2026•0•22

Detects exploitation attempts of CVE-2026-22769 by identifying PUT requests directed at the Tomcat Manager application deployment endpoint. This is used by UNC6201 to deploy malicious WAR files containing the SLAYSTYLE webshell.