SonicWall Shocker: Sneaky OVERSTEP Backdoor Dodges Security Updates!
UNC6148 is targeting SonicWall SMA 100 series appliances, dropping a sneaky backdoor named OVERSTEP. By using stolen credentials, they’re maintaining access like a cat burglar with a key. Google suggests organizations should capture disk images to outsmart this digital Houdini before more data theft or ransomware antics unfold.
Hot Take:
SonicWall appliances are the gift that keeps on giving… to cybercriminals! It seems like UNC6148 has found a way to turn outdated tech into their personal playground, and OVERSTEP is the uninvited guest that just won’t leave. This is one party that SonicWall never RSVP’d to!
Key Points:
- UNC6148 targets end-of-life SonicWall SMA 100 series appliances with a backdoor named OVERSTEP.
- Credentials and OTP seeds from previous intrusions enable re-access despite updates.
- Initial access vector unknown, possibly via known vulnerabilities or zero-day flaws.
- OVERSTEP modifies boot processes and evades detection with a usermode rootkit.
- Linked to data theft, extortion operations, and potentially ransomware deployment.
Already a member? Log in here