Loading story…
Google Threat Intelligence Group reported an ongoing campaign targeting fully patched, end-of-life SonicWall SMA 100 appliances, where suspected financially motivated actor UNC6148 deployed the OVERSTEP backdoor to maintain persistent access, steal credentials, and evade detection by selectively removing log entries and modifying the boot process. The activity appears to date back to at least October 2024 and affected SMA 210, SMA 410, and SMA 500v devices, with the actor reportedly regaining access using previously stolen administrator credentials and OTP seeds; investigators also assessed with moderate confidence that an unknown zero-day remote code execution path may have been used to install the malware and obtain shell access.
Subsequent reporting said SonicWall released updated firmware for SMA 100 appliances that adds advanced file integrity checks to detect and remove known rootkits, after exploitation tied the campaign to CVE-2024-38475 in Apache HTTP Server and CVE-2025-40599 in SonicWall SMA 100. The intrusions enabled reverse shells and theft of sensitive data including persist.database, certificates, credentials, and OTP seeds, and were linked to follow-on extortion and possible ransomware activity, including overlap with incidents associated with Abyss-branded ransomware and a victim later named on the World Leaks site; defenders were urged to apply SonicWall guidance, rotate all credentials, reset MFA tokens, and consider migration as SMA 100 support ended.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK stated that SonicWall urged administrators to consider migration because support for SMA 100 ended on October 1, 2025. This marked the platform's end-of-support status.
CSIRT.SK reported that SonicWall released a firmware update for SMA 100 series appliances that adds advanced file integrity checking to detect and remove known rootkits. The update was described as a response to active exploitation involving UNC6148 and OVERSTEP.
On its July 2025 publication, GTIG disclosed that suspected financially motivated actor UNC6148 was deploying a newly identified persistent backdoor and user-mode rootkit called OVERSTEP on SonicWall SMA 100 appliances. GTIG said the malware modified the boot process, stole credentials, hid its components, and may have been deployed via an unknown zero-day RCE.
GTIG cited a victim from May 2025 that was later posted to the World Leaks leak site in June 2025, indicating the campaign may support data theft and extortion. This linked the activity to downstream public extortion pressure.
Google Threat Intelligence Group assessed that the ongoing campaign targeting fully patched, end-of-life SonicWall SMA 100 series appliances dates back to at least October 2024. The actor was believed to regain access using administrator credentials and OTP seeds stolen in earlier intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcecloud.google.com
Open sourcepsirt.global.sonicwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet-facing **SonicWall SMA 1000** appliances are under active exploitation through a zero-click, pre-authentication chain that combines `CVE-2026-15409` and `CVE-2026-15410` to deliver unauthenticated **root compromise**. Resecurity reported exploitation began by at least June 22, before SonicWall released July fixes, and identified **INC Ransomware** as the primary actor observed using the full chain. The attack abuses a `wsproxy` bypass to reach localhost-only services and then uses a path traversal flaw in the hotfix-removal process to execute a staged script with root privileges. Affected products include **SMA 6210, SMA 7210, SMA 8200v, and vCMS** in the SMA 1000 line, while SonicWall firewall SSL VPN and SMA 100 Series products are not affected. Post-compromise activity included persistent backdoors, an HTTP forwarding proxy, a memory-resident web shell, packet capture targeting unencrypted LDAP traffic, startup and routing changes for persistence, credential-theft opportunities, and use of the appliance as a pivot into internal networks. SonicWall advised organizations to upgrade to fixed firmware, preserve logs, hunt for indicators of compromise, and treat exposed devices as potentially breached, with rebuilds or factory resets and credential rotation recommended where intrusion is suspected.
Aug 4, 2026
SonicWall has issued firmware version 10.2.2.2-92sv for SMA 100 series devices, enabling removal of the OVERSTEP rootkit deployed by threat group UNC6148. The update addresses exploitation via CVE-2024-38475 and includes additional file-checking capabilities. Organizations are urged to upgrade, rotate credentials, and consider migrating to supported hardware as end-of-support for SMA 100 series is accelerated to December 31, 2025.
Jun 29, 2026
SonicWall has released urgent patches for a local privilege escalation vulnerability (CVE-2025-40602) in its Secure Mobile Access (SMA) 1000 appliances, following reports of active exploitation in the wild. Attackers have been chaining this flaw with a previously patched deserialization vulnerability (CVE-2025-23006) to achieve unauthenticated remote code execution with root privileges on affected devices. The vulnerabilities impact the Appliance Management Console (AMC) and Central Management Console (CMC), and SonicWall has advised customers to upgrade to the latest hotfix versions and restrict management interface access to mitigate risk. Security advisories from multiple sources, including government agencies and SonicWall itself, emphasize the criticality of patching due to the widespread use of SMA1000 appliances in large enterprises and critical infrastructure. Over 950 internet-exposed SMA1000 devices have been identified, heightening concerns about potential exploitation. No indicators of compromise have been released, but organizations are urged to apply the fixes immediately and review their exposure to the AMC and SSH interfaces to prevent further attacks.
Jul 23, 2026