← All hunts critical TLP:CLEAR Part 2 of 2

UNC6201 Network Evasion and C2

An adversary is using iptables REDIRECT rules for Single Packet Authorization and DNS-over-HTTPS for command-and-control to hide ingress traffic and outbound beacons on compromised appliances.

Based on research by Mandiant 2026-09-20 9 steps · 3 queries T1071 T1090.003 T1190

Run hunt Download hunt.md

Brief

Why this hunt?

Mandiant recently detailed UNC6201 exploiting a Dell RecoverPoint zero-day. The threat actor gains initial access, then secures their foothold using custom persistence and highly evasive network tradecraft. They use Single Packet Authorization (SPA) to hide ingress and DNS-over-HTTPS (DoH) to mask egress. This hunt focuses on identifying these stealthy network pivots within your environment.

How the hunt flows

The hunt begins by scoping the environment for Dell RecoverPoint for Virtual Machines. The first query searches the software inventory to identify high-value targets and narrow the search space to the relevant Linux-based appliances. This ensures the subsequent, more intensive queries focus on the most likely points of entry.

Once the scope is set, the hunt fans out into two parallel queries. The first query searches process activity for specific iptables command-line arguments. The adversary uses redirection rules and the u32 module or hex-string matching to implement SPA, allowing them to open ports only when a specific packet sequence is received.

The second branch of the fan-out examines DNS activity. It looks for resolution attempts to common DoH providers like Google, Cloudflare, and NextDNS. Because DoH is common in modern browsers, the hunt baselines this activity across the fleet and focuses on rare lookups originating from the appliances identified in the scoping phase.

An automated agent then correlates these findings. It looks for hosts that exhibit both unusual iptables manipulation and rare DoH activity. If the agent finds a match, it routes the host for isolation and triggers an analyst review to confirm the presence of a web shell or unauthorized persistence.

What this hunt cannot see

This hunt relies on process-level telemetry for iptables. If the adversary manipulates the network stack through direct kernel module interaction or direct API calls that bypass the iptables binary, the process logs will remain silent. Additionally, this hunt does not cover VMware infrastructure changes, such as the creation of "Ghost NICs" on ESXi hosts, as that requires audit logs from the hypervisor layer which are not currently part of the target surfaces.

Why this is a hunt, not a detection

A standard detection rule for iptables commands often triggers false positives because administrators use the utility for legitimate network maintenance. Similarly, DNS-over-HTTPS is increasingly common in modern environments. This playbook functions as a hunt because it applies environmental context: it baselines DoH activity against the fleet and only alerts when it correlates with rare, specific network redirection commands on high-value appliances.

In this series

Part 1: Dell RecoverPoint Appliance Intrusion and Persistence

Steps

Scope potentially vulnerable Dell appliances
Query · scoping

Identify Dell RecoverPoint for Virtual Machines software in the inventory to narrow the focus to high-value targets.
reads hb_software_inventorysql
```
SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%recoverpoint%' OR LOWER(vendor_name) LIKE '%dell%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```
What a hit looks like. A list of hostnames running Dell RecoverPoint software. Silence means no such software is managed or reported in inventory.

SPA and iptables redirection activity

Query · detection candidate

Detect the use of iptables to establish Single Packet Authorization or port redirection patterns.

reads hb_process_activitysql

SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%iptables%' OR LOWER(process_cmd_line) LIKE '%iptables%') AND (LOWER(process_cmd_line) LIKE '%redirect%' OR LOWER(process_cmd_line) LIKE '%--hex-string%' OR LOWER(process_cmd_line) LIKE '%--u32%' OR LOWER(process_cmd_line) LIKE '%-m u32%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')

What a hit looks like. A process execution row showing iptables used to redirect traffic or match strings. Silence proves no such commands were captured by process monitoring.

DNS-over-HTTPS resolution patterns

Query · baseline

Identify hosts resolving common DoH providers which may indicate encrypted C2 traffic.

reads hb_dns_activitysql

SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{doh_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname

What a hit looks like. Lookup events for DoH domains. Rare lookups from appliances are suspicious; frequent lookups from browsers are baseline.

Evaluate network evasion evidence
Agent triage

Review findings from iptables and DNS activity to determine if an appliance is likely being used as a C2 pivot.
Determine response action
Decision

Route the hunt to isolation if the agent finds malicious network evasion patterns.
Isolate compromised host
Response action

Prevent further lateral movement or C2 by isolating the suspected pivot host.
Review triage findings
Analyst task

An analyst reviews the evidence of network evasion to confirm the threat and check for additional pivots.
Close out hunt
Analyst task

Record findings and update detection rules.

Coverage

Scenario coverage

Stage	Covered	How, or why not
Stealthy Proxying via IPTables T1090.003	Yes	iptables-redirection-commands
C2 via DNS-over-HTTPS T1071	Yes	dns-over-https-activity
Lateral Movement via Ghost NICs T1090.003	Not visible	No virtual machine hardware audit source is available in the hb_ surfaces to detect Ghost NIC creation.
Tomcat Manager Zero-Day Exploitation T1190 · T1133	Out of scope	Belongs to another part of the 'UNC6201 exploiting a Dell RecoverPoint zero-day' series.
SLAYSTYLE Web Shell Deployment T1505.003	Out of scope	Belongs to another part of the 'UNC6201 exploiting a Dell RecoverPoint zero-day' series.
Backdoor Persistence via Boot Script T1505.003	Out of scope	Belongs to another part of the 'UNC6201 exploiting a Dell RecoverPoint zero-day' series.

Blind spots

Parameters & data

Parameters

Parameter	Type	Default	What it is
`doh_domains`	list[domain]	dns.google, cloudflare-dns.com, dns.google.com, dns.nextdns.io	Known DNS-over-HTTPS provider domains.
`lookback_days`	number	14	Days of history to examine.
`scope_hosts`	list[host]	—	Optional list of hostnames to focus on; leave empty to hunt across the estate.

Telemetry

Source	Category	Telemetry
Endpoint telemetry (hb_ surfaces)	endpoint	endpoint

Source

Download hunt.md Definition (JSON) An open hunt.md file; it runs anywhere that reads the format.

---
analysis: A single detection rule would struggle to distinguish legitimate iptables
  administration from SPA redirection. This hunt baselines DoH activity against the
  fleet and correlates it with specific, rare network redirection commands to identify
  an active pivot.
blind_spots:
- id: missing-process-telemetry
  question: What iptables commands were executed by the web shell?
  requires: hb_process_activity with command-line logging on Linux
  risk: If iptables manipulation is performed via a direct API call or kernel module
    rather than the binary, this hunt will not see it.
  stage: stealthy-iptables-proxying
- id: no-esxi-hardware-telemetry
  question: Were Ghost NICs created on virtual machines?
  requires: vCenter/ESXi audit logs showing hardware configuration changes
  risk: The creation of temporary virtual network interfaces is not visible in standard
    endpoint process or network connection surfaces.
  stage: vmware-infrastructure-pivoting
coverage:
- stage: stealthy-iptables-proxying
  status: covered
  steps:
  - iptables-redirection-commands
- stage: c2-doh-communication
  status: covered
  steps:
  - dns-over-https-activity
- blind_spot: no-esxi-hardware-telemetry
  reason: No virtual machine hardware audit source is available in the hb_ surfaces
    to detect Ghost NIC creation.
  stage: vmware-infrastructure-pivoting
  status: not_visible
- reason: Belongs to another part of the 'UNC6201 exploiting a Dell RecoverPoint zero-day'
    series.
  stage: tomcat-manager-zero-day-exploit
  status: out_of_scope
- reason: Belongs to another part of the 'UNC6201 exploiting a Dell RecoverPoint zero-day'
    series.
  stage: webshell-war-persistence
  status: out_of_scope
- reason: Belongs to another part of the 'UNC6201 exploiting a Dell RecoverPoint zero-day'
    series.
  stage: boot-script-backdoor-persistence
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Exploitation of zero-day vulnerabilities in edge appliances (Dell
    RecoverPoint) and vCenter by UNC6201 presents a critical risk of persistent, high-privileged
    access and stealthy network pivoting.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary is using iptables REDIRECT rules for Single Packet Authorization
  and DNS-over-HTTPS for command-and-control to hide ingress traffic and outbound
  beacons on compromised appliances.
labels:
- hunt
- attack.t1071
- attack.t1090.003
- attack.t1190
name: UNC6201 Network Evasion and C2
parameters:
  doh_domains:
    default:
    - dns.google
    - cloudflare-dns.com
    - dns.google.com
    - dns.nextdns.io
    description: Known DNS-over-HTTPS provider domains.
    from:
      kind: article
      observed: '2025-09-01'
      ref: unc6201-exploitation
    type: list[domain]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Optional list of hostnames to focus on; leave empty to hunt across
      the estate.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: The hunt should prioritize internet-facing Linux appliances and hosts identified
  in the software inventory as Dell RecoverPoint or vCenter.
references:
- name: UNC6201 exploiting a Dell RecoverPoint zero-day
  url: https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day
related:
- hunt: unc6201-initial-access-webshells
  reason: Initial access via Tomcat Manager and SLAYSTYLE webshell persistence is
    handled in the companion hunt.
  relation: out-of-scope-alternative
- hunt: dell-recoverpoint-intrusion-persistence
  relation: follows
scenario:
  stages:
  - name: Tomcat Manager Zero-Day Exploitation
    observables:
    - CVE-2026-22769
    - HTTP PUT /manager/text/deploy?path=/
    - admin user authentication to Apache Tomcat Manager
    - /home/kos/tomcat9/tomcat-users.xml
    - /home/kos/auditlog/fapi_cl_audit_log.log
    slug: tomcat-manager-zero-day-exploit
    tactic: initial-access
    techniques:
    - T1190
    - T1133
  - name: SLAYSTYLE Web Shell Deployment
    observables:
    - Malicious WAR file upload to /var/lib/tomcat9
    - org.apache.catalina.startup.HostConfig.deployWAR
    - /var/cache/tomcat9/Catalina
    - java.io
    - Base64.getDecoder
    - Runtime.getRuntime().exec
    slug: webshell-war-persistence
    tactic: persistence
    techniques:
    - T1505.003
  - name: Backdoor Persistence via Boot Script
    observables:
    - Modification of /home/kos/kbox/src/installation/distribution/convert_hosts.sh
    - Execution via /etc/rc.local at boot
    - GRIMBOLT C# Native AOT binary packed with UPX
    - BRICKSTORM binary replacement
    slug: boot-script-backdoor-persistence
    tactic: persistence
    techniques:
    - T1505.003
  - name: Stealthy Proxying via IPTables
    observables:
    - iptables -I INPUT -i eth0 -p tcp --dport 443 -m string --hex-string
    - iptables REDIRECT --to-ports 10443
    - Monitoring port 443 for Single Packet Authorization (SPA)
    - Systemd Journal command recovery
    slug: stealthy-iptables-proxying
    tactic: command-and-control
    techniques:
    - T1090.003
  - name: C2 via DNS-over-HTTPS
    observables:
    - DNS-over-HTTPS queries to Google, Cloudflare, and Amazon DNS services
    - C2 traffic associated with GRIMBOLT and BRICKSTORM
    slug: c2-doh-communication
    tactic: command-and-control
    techniques:
    - T1071
  - name: Lateral Movement via Ghost NICs
    observables:
    - Creation of temporary network ports (Ghost NICs) on virtual machines
    - Pivoting from ESXi servers to internal or SaaS infrastructure
    slug: vmware-infrastructure-pivoting
    tactic: lateral-movement
    techniques:
    - T1090.003
  summary: Suspected PRC-nexus actor UNC6201 exploited a zero-day (CVE-2026-22769)
    in Dell RecoverPoint for Virtual Machines using hardcoded Tomcat Manager credentials.
    They established persistent access via SLAYSTYLE web shells and backdoors, utilizing
    modified boot scripts and complex iptables rules for stealthy network proxying
    and Single Packet Authorization.
series:
  index: 2
  slug: unc6201-exploiting-a-dell-recoverpoint-zero-day
  title: UNC6201 exploiting a Dell RecoverPoint zero-day
  total: 2
severity: critical
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
tlp: clear
type: investigation
---


# UNC6201 Network Evasion and C2

This hunt identifies stealthy network proxying and evasive command-and-control patterns associated with UNC6201 activity. The hunt first scopes for vulnerable Dell RecoverPoint appliances and then fans out to look for specific iptables manipulation used for traffic redirection (SPA) and attempts to resolve known DNS-over-HTTPS providers. An agent weighs these network-level indicators to identify hosts being used as stealthy pivots.

## scope-vulnerable-appliances
<!-- Scope potentially vulnerable Dell appliances -->
Identify Dell RecoverPoint for Virtual Machines software in the inventory to narrow the focus to high-value targets.

```sqlite target=endpoint role=scoping params=(scope_hosts=scope_hosts)
~~~yaml
expected: A list of hostnames running Dell RecoverPoint software. Silence means no
  such software is managed or reported in inventory.
reads:
- device_hostname
- package_name
- package_version
- install_path
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%recoverpoint%' OR LOWER(vendor_name) LIKE '%dell%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## network-evasion-fan-out
<!-- Search for proxy and C2 evidence -->
parallel:
- → iptables-redirection-commands
- → dns-over-https-activity
join: → triage-network-evasion

## iptables-redirection-commands
<!-- SPA and iptables redirection activity -->
Detect the use of iptables to establish Single Packet Authorization or port redirection patterns.

```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: A process execution row showing iptables used to redirect traffic or match
  strings. Silence proves no such commands were captured by process monitoring.
reads:
- device_hostname
- process_cmd_line
- user_name
- time
silence: evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%iptables%' OR LOWER(process_cmd_line) LIKE '%iptables%') AND (LOWER(process_cmd_line) LIKE '%redirect%' OR LOWER(process_cmd_line) LIKE '%--hex-string%' OR LOWER(process_cmd_line) LIKE '%--u32%' OR LOWER(process_cmd_line) LIKE '%-m u32%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## dns-over-https-activity
<!-- DNS-over-HTTPS resolution patterns -->
Identify hosts resolving common DoH providers which may indicate encrypted C2 traffic.

```sqlite target=endpoint role=baseline params=(doh_domains=doh_domains, scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Lookup events for DoH domains. Rare lookups from appliances are suspicious;
  frequent lookups from browsers are baseline.
prevalence:
  by: device_hostname
  key:
  - query_hostname
  rare_below: 3
reads:
- device_hostname
- query_hostname
- time
silence: not_evidence_of_absence
source: hb_dns_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_seen FROM hb_dns_activity WHERE instr(',' || '{{doh_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname
```

## triage-network-evasion
<!-- Evaluate network evasion evidence -->
```agent target=hunter
cite: required
context:
- scope-vulnerable-appliances
- iptables-redirection-commands
- dns-over-https-activity
max_iterations: 3
objective: Determine if any host exhibits both iptables redirection commands and rare
  DoH resolution activity, suggesting a persistent pivot.
success_criteria: Verdicts for each examined host citing the specific iptables command
  or DNS query. You must explicitly filter the findings from iptables-redirection-commands
  and dns-over-https-activity to focus only on the hosts identified in scope-vulnerable-appliances.
tools:
- endpoint
```

## decide-on-isolation
<!-- Determine response action -->
if~: "the triage-network-evasion verdict is malicious for at least one host" (confidence: high, judge=hunter)
then: → isolate-compromised-host
indeterminate: → analyst-triage-review
unavailable: → analyst-triage-review (blind_spot: missing-process-telemetry)
else: → analyst-triage-review

## isolate-compromised-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host identified as malicious and verify that the iptables rules are preserved for forensic analysis.
```
→ analyst-triage-review

## analyst-triage-review
<!-- Review triage findings -->
```manual target=analyst
Verify the cited iptables commands. If malicious, perform a full disk image analysis focusing on the /var/log/tomcat9 and /home/kos directories.
```
→ close-out-hunt

## close-out-hunt
<!-- Close out hunt -->
```manual target=analyst
Record whether the iptables rules were legitimate or malicious. If malicious, ensure the host is remediated by applying the Dell RecoverPoint hotfix.
```
→ end

Run it

Take this hunt into your environment.

Open it in Huntbase to run every step against your own connections, with Scout weighing the evidence and your analysts in command. Or take the open hunt.md file anywhere that reads the format.

Run hunt Download hunt.md Definition (JSON)

Machine-drafted by huntbase-hunt-generation using hb_google/gemini-3-flash-preview, gated by dry-run, lint, then reviewed by a person.