Dell ControlVault 'ReVault' Exploitation Activity

sumanth markapuarapu@sumanth

•updated Aug 7, 2025•1•22

Detects potential exploitation of Dell ControlVault vulnerabilities (dubbed 'ReVault') by monitoring for related service crashes or the abnormal loading of the `bcmbipdll.dll` module. An attacker with local access can exploit these vulnerabilities for privilege escalation or persistence.