SonicWall Secure Mobile Access Attack

A new custom backdoor malware aimed at SonicWall appliances

A campaign targeting SonicWall SMA 100 series appliances is currently under active exploitation, leveraging both known vulnerabilities and potential zero-days to gain persistent access to enterprise networks. The threat actors deploy a custom Linux-based rootkit for stealth and long-term persistence. Learn More »

Common Vulnerabilities and Exposures

Background

This ongoing campaign was identified by the Google Threat Intelligence Group (GTIG) and has been attributed, with moderate confidence, to a suspected financially motivated threat actor tracked as UNC6148.

Attackers used a mix of known vulnerabilities and likely an unknown (zero-day) flaw to break into these devices. Once inside, they stole admin credentials and one-time password (OTP) data, allowing them to reconnect through VPNs and stay hidden in the network over time even after security updates are installed. This campaign focused on exploiting edge devices as an entry point into company systems.

A key component of the campaign was the deployment of OVERSTEP, a custom Linux-based rootkit designed for stealth and persistence. Installed on the targeted appliances, OVERSTEP allowed attackers to maintain control, exfiltrate sensitive credentials and certificates, manipulate logs to erase evidence, and initiate outbound communication for command-and-control.