Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit – Source: go.theregister.com

Updated Unknown miscreants are exploiting fully patched, end-of-life SonicWall VPNs to deploy a previously unknown backdoor and rootkit, likely for data theft and extortion, according to Google’s Threat Intelligence Group.

In research published on Wednesday, the Chocolate Factory’s intel analysts attribute the ongoing campaign to UNC6148 – UNC in Google’s threat-actor naming taxonomy stands for “Uncategorized.” They appear to be using a backdoor rootkit dubbed OVERSTEP.

Once the miscreants compromised the SonicWall appliances, they deployed a previously unknown backdoor written in C. The malware modified the appliance’s boot process to maintain persistent access, enabling the criminals to steal sensitive credentials and conceal their own components. 

The researchers assess “with high confidence” that the criminals are abusing previously stolen credentials and one-time password seeds, which allow them to maintain access to the compromised SonicWall Secure Mobile Access (SMA) 100 series appliances even after organizations have patched the buggy VPNs.

How the attack works

Mandiant, Google’s incident response arm, investigated one of the intrusions connected with this UNC6148 campaign, and determined that in June the crew established an SSL-VPN session on the SonicWall gear using local administrator credentials.

“Mandiant’s first observations of UNC6148 in a recent investigation showed that they already had local administrator credentials to the targeted SMA 100 series appliance, and no forensic evidence nor other data was identified to show how those credentials were obtained,” according to the report.

Additionally, there’s not much visibility into the attackers’ initial infection vector because the malware selectively removes log entries. 

However, the Googlers say they most likely exploited known vulnerabilities including: CVE-2021-20038, CVE-2024-38475, CVE-2021-20035, CVE-2021-20039, or CVE-2025-32819.

Or they may have used a zero-day: “GTIG assesses with moderate confidence that UNC6148 may have used an unknown, zero-day remote code execution vulnerability to deploy OVERSTEP on targeted SonicWall SMA appliances,” according to the threat hunters.

After establishing an SSL-VPN session, UNC6148 spawned a reverse shell on the compromised appliance — even though this should not be possible because of the SMA 100 series’ firmware.

Neither Mandiant nor SonicWall’s Product Security Incident Response Team could determine how the attacker established the reverse shell, but Google said “it’s possible” they exploited an unknown security flaw.

After establishing the reverse shell, the miscreants can use the attack code to conduct initial reconnaissance and set new network access control policy rules to allow IP addresses used by UNC6148.

Then they installed OVERSTEP, manually cleared the system logs, and restarted the appliance to activate the backdoor. To achieve persistence, UNC6148 modified a legitimate run command file so that whenever the appliance rebooted, the malware would load and execute, thus ensuring the attackers maintained admin-level privileges and full access.

In addition to establishing a reverse shell and its rootkit capabilities, OVERSTEP also allows the criminals to steal passwords, security certificates, and OTPs from the compromised appliance.

“In our investigations, GTIG observed beaconing traffic from compromised appliances, but we did not identify notable post-compromise activities,” the report notes, adding that the attackers “success in hiding their tracks is largely due to OVERSTEP’s capability to selectively delete log entries from httpd.log, http_request.log, and inotify.log.”

• Beware of fake SonicWall VPN app that steals users’ credentials
• SonicWall firewalls now under attack: Patch ASAP or risk intrusion via your SSL VPN
• SonicWall flags critical bug likely exploited as zero-day, rolls out hotfix
• Make sure you’re up-to-date with Sonicwall SMA 100 VPN box patches – security hole exploit info is now out

A Google spokesperson told The Register the number of known victims is “limited,” and urged businesses that use these SonicWall devices to analyze them for signs of compromise, especially if they are vulnerable to any of the earlier known CVEs, following the steps outlined in the “Hunting and Detection” section of the technical analysis. This lists several indicators of compromise and other artifacts to help defenders find — and boot off — OVERSTEP on their systems.

Ransomware? It’s not off the table…

UNC6148 has been active since at least October 2024, and Google asserts “with moderate confidence” that its operations focus on data theft, extortion, and possibly ransomware.

“An organization targeted by UNC6148 in May 2025 was posted to the World Leaks data-leak site in June 2025, and UNC6148 activity overlaps with publicly reported SonicWall exploitation from late 2023 and early 2024 that has been publicly linked to the deployment of Abyss-branded ransomware (tracked by GTIG as VSOCIETY),” the researchers noted.

While the biggest risk to organizations comes from OVERSTEP’s capabilities to steal sensitive files, the Googlers note that they “did not directly observe the weaponization of this stolen data.” However, they add, it “creates a clear path for persistent access,” and as such, any compromised organizations should get rid of all secrets stored on infected appliances ASAP. ®

Updated to add

SonicWall did not respond to The Register‘s initial questions about the intrusions targeting its appliances. After we published our story, however, a spokesperson emailed us a lengthy statement.

“SonicWall is aware of the recent report by Google Threat Intelligence Group (GTIG) identifying an active campaign targeting SMA 100 series appliances,” the company representative said, adding that the security appliance vendor is “working closely with GTIG throughout this process.”

In light of this campaign, and the changing threat landscape, SonicWall also plans to speed up its end-of-support date for the SMA 100, and help move customers to its Cloud Secure Edge service and the SMA 1000 series instead, we’re told.

“The SMA 100 has already reached end-of-sale status, as reflected in our Product Lifecycle Table, and this update aligns with our long-term strategy and industry direction,” the spokesperson said.

“Detailed migration guidance to SonicWall’s Zero Trust solutions will be shared with customers and partners in the coming weeks,” the statement added. “Our priority remains clear: ensuring the security and success of our customers during this transition and beyond.”