Ransomware actors target patched SonicWall SMA devices with rootkit – Source: www.csoonline.com

A group of hackers known for stealing enterprise data for extortion purposes has developed a persistent rootkit for SonicWall Secure Mobile Access (SMA) 100 series appliances. The rootkit was seen deployed on end-of-life but fully patched SMA 100 appliances with the help of administrative credentials likely obtained in past compromises.

“GTIG assesses with high confidence that UNC6148 is leveraging credentials and one-time password (OTP) seeds stolen during previous intrusions, allowing them to regain access even after organizations have applied security updates,” researchers from Google Threat Intelligence Group and Mandiant wrote in a report on the group’s activity.

The deployed rootkit is designed to delete log entries, thereby impacting the ability to perform forensic investigation. As such, no initial access vector could be established with certainty, but Google’s researchers believe the group leveraged known vulnerabilities.

Attackers linked to ransomware and data leak extorsions

Google-owned incident response firm Mandiant tracks the group as UNC6148 and believes the group’s goal is to gain access to organizations for the purpose of data theft, extortion, and ransomware deployment. Data stolen from an organization compromised by UNC6148 in May was posted on data leak site World Leaks last month.

The group might have a history of targeting SonicWall SMA appliances, with attacks during 2023 and 2024 resulting in deployed web shells and later the infection of the victim’s networks with the Abyss ransomware, also known as VSOCIETY.

Google’s researchers believe in-the-wild exploitations of previous SonicWall SMA 100 vulnerabilities might have led to the theft of administrative credentials used in recent attacks. One vulnerability patched last year, CVE-2024-38475, stands out because it allows unauthenticated attackers to extract from SMA appliances two SQLite databases, temp.db and persist.db, that store sensitive information, including user account credentials, session tokens, and OTP seed values.

Although the flaw has been publicly documented and analyzed in detail by researchers as potentially leading to the exposure of admin credentials, GTIG and Mandiant don’t have evidence this is the flaw that was exploited. It is also possible the admin credentials for the appliances were obtained from infostealer malware logs.

Custom backdoor with reboot persistence

What stands out about the attack is the deployment of a user-mode rootkit that persists across device reboots, which Mandiant has dubbed OVERSTEP.

The attackers first established a VPN connection to the compromised appliance using local admin credentials and then opened a reverse shell on the appliance.

“Shell access should not be possible by design on these appliances, and Mandiant’s joint investigation with the SonicWall Product Security Incident Response Team (PSIRT) did not identify how UNC6148 established this reverse shell,” the researchers wrote. “It’s possible the reverse shell was established via exploitation of an unknown vulnerability by UNC6148.”

Following several reconnaissance commands, the attackers exported and then reimported the appliance configuration, including network access control policies for IP addresses they controlled. Finally, a base64-encoded payload was dropped as a file called /usr/lib/libsamba-errors.so.6 and was added to the /etc/ld.so.preload list, which contains a list of libraries to load.

The RC file that controls which processes are started at reboot was modified to ensure that the malware gets added to the running filesystem when the appliance starts. This was achieved by adding code to the bootCurrentFirmware function in the rc.fwboot. It’s worth noting that these appliances have locked-down filesystems at startup to ensure only legitimate components exist. Admins are not even supposed to have access to the internal operating system.

The OVERSTEP backdoor, written in C, is specifically designed for SonicWall SMA 100 series appliances. It injects itself into the memory of other processes via the /etc/ld.so.preload file and then hijacks standard file system functions such as open, open64, readdir, readdir64, and write. This allows it to hide its components on the system.

The backdoor’s main purpose is to steal passwords and provide attackers with a reverse shell on the system, through which they can execute additional shell commands.

“In our investigations, GTIG observed beaconing traffic from compromised appliances, but we did not identify notable post-compromise activities,” the researchers wrote. “The actor’s success in hiding their tracks is largely due to OVERSTEP’s capability to selectively delete log entries from httpd.log, http_request.log, and inotify.log. This anti-forensic measure, combined with a lack of shell history on disk, significantly reduces visibility into the actor’s secondary objectives.”

Mitigations

Mandiant has tracked the targeting of SMA 100 series appliances by UNC6148 since October 2024. The researchers advise organizations to analyze their SMA 100 series appliances to determine whether they have been compromised, even if they run the latest fully patched version of the firmware.

This might involve talking with SonicWall about ways to extract disk images from the appliances instead of executing commands directly on them, because they would be subject to interference from the rootkit.

The GTIG and Mandiant report includes indicators of compromises, including file names and hashes associated with the malware, as well as modifications of several system files. If any of these are found, organizations should isolate the impacted appliance and rotate all credentials that might have been stored on them.