Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor
A financially-motivated threat actor, UNC6148, is targeting fully patched end-of-life SonicWall SMA 100 series appliances. They are using stolen credentials and OTP seeds from previous intrusions to regain access. The actor has deployed a new persistent backdoor/user-mode rootkit called OVERSTEP, which modifies the appliance's boot process, steals credentials, and conceals itself. UNC6148 may be using an unknown zero-day vulnerability for deployment. The campaign, ongoing since October 2024, aims at data theft, extortion, and possibly ransomware deployment. OVERSTEP's functionality includes establishing reverse shells, exfiltrating passwords, and implementing usermode rootkit capabilities. Organizations are advised to rotate all credentials and follow provided recommendations to mitigate the threat.
Pulse ID: 6879f91ca3f7a11b698fd127
Pulse Link: https://otx.alienvault.com/pulse/6879f91ca3f7a11b698fd127
Pulse Author: AlienVault
Created: 2025-07-18 07:34:52
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
