Loading story…
SonicWall has issued firmware version 10.2.2.2-92sv for SMA 100 series devices, enabling removal of the OVERSTEP rootkit deployed by threat group UNC6148. The update addresses exploitation via CVE-2024-38475 and includes additional file-checking capabilities. Organizations are urged to upgrade, rotate credentials, and consider migrating to supported hardware as end-of-support for SMA 100 series is accelerated to December 31, 2025.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
SonicWall's SMA 100 series appliances were scheduled to reach end-of-support, increasing urgency for customers to upgrade or replace affected devices amid the ongoing UNC6148 campaign.
The Canadian Centre for Cyber Security published advisory AV25-612 covering the SonicWall security issue, reflecting government awareness and dissemination of mitigation guidance related to the SMA threat activity and remediation.
In a separate advisory referenced alongside the SMA campaign, SonicWall said a malicious actor used brute-force techniques against the MySonicWall.com portal and accessed firewall configuration or customer information tied to its cloud backup service. SonicWall said the incident affected fewer than 5% of its firewall installed base.
SonicWall released firmware version 10.2.2.2-92sv for SMA 210, 410, and 500v appliances, adding file-checking and rootkit-removal capabilities aimed at detecting and wiping known OVERSTEP malware. The company urged customers to upgrade immediately and follow additional remediation guidance.
Google Threat Intelligence Group reported an ongoing campaign in which threat actor UNC6148 targeted SonicWall SMA 100 series appliances, including fully patched end-of-life devices, deploying the previously unknown OVERSTEP backdoor/rootkit for persistence, credential theft, and evasion. GTIG said the actor may have used stolen credentials and OTP seeds from prior breaches and possibly an unknown zero-day remote code execution flaw.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group reported an ongoing campaign targeting fully patched, end-of-life SonicWall SMA 100 appliances, where suspected financially motivated actor **UNC6148** deployed the **OVERSTEP** backdoor to maintain persistent access, steal credentials, and evade detection by selectively removing log entries and modifying the boot process. The activity appears to date back to at least October 2024 and affected SMA 210, SMA 410, and SMA 500v devices, with the actor reportedly regaining access using previously stolen administrator credentials and OTP seeds; investigators also assessed with moderate confidence that an unknown zero-day remote code execution path may have been used to install the malware and obtain shell access. Subsequent reporting said SonicWall released updated firmware for SMA 100 appliances that adds advanced file integrity checks to detect and remove known rootkits, after exploitation tied the campaign to **`CVE-2024-38475`** in Apache HTTP Server and **`CVE-2025-40599`** in SonicWall SMA 100. The intrusions enabled reverse shells and theft of sensitive data including `persist.database`, certificates, credentials, and OTP seeds, and were linked to follow-on extortion and possible ransomware activity, including overlap with incidents associated with Abyss-branded ransomware and a victim later named on the **World Leaks** site; defenders were urged to apply SonicWall guidance, rotate all credentials, reset MFA tokens, and consider migration as SMA 100 support ended.
Jul 24, 2026
SonicWall has released urgent patches for a local privilege escalation vulnerability (CVE-2025-40602) in its Secure Mobile Access (SMA) 1000 appliances, following reports of active exploitation in the wild. Attackers have been chaining this flaw with a previously patched deserialization vulnerability (CVE-2025-23006) to achieve unauthenticated remote code execution with root privileges on affected devices. The vulnerabilities impact the Appliance Management Console (AMC) and Central Management Console (CMC), and SonicWall has advised customers to upgrade to the latest hotfix versions and restrict management interface access to mitigate risk. Security advisories from multiple sources, including government agencies and SonicWall itself, emphasize the criticality of patching due to the widespread use of SMA1000 appliances in large enterprises and critical infrastructure. Over 950 internet-exposed SMA1000 devices have been identified, heightening concerns about potential exploitation. No indicators of compromise have been released, but organizations are urged to apply the fixes immediately and review their exposure to the AMC and SSH interfaces to prevent further attacks.
Jul 23, 2026
Internet-facing **SonicWall SMA 1000** appliances are under active exploitation through a zero-click, pre-authentication chain that combines `CVE-2026-15409` and `CVE-2026-15410` to deliver unauthenticated **root compromise**. Resecurity reported exploitation began by at least June 22, before SonicWall released July fixes, and identified **INC Ransomware** as the primary actor observed using the full chain. The attack abuses a `wsproxy` bypass to reach localhost-only services and then uses a path traversal flaw in the hotfix-removal process to execute a staged script with root privileges. Affected products include **SMA 6210, SMA 7210, SMA 8200v, and vCMS** in the SMA 1000 line, while SonicWall firewall SSL VPN and SMA 100 Series products are not affected. Post-compromise activity included persistent backdoors, an HTTP forwarding proxy, a memory-resident web shell, packet capture targeting unencrypted LDAP traffic, startup and routing changes for persistence, credential-theft opportunities, and use of the appliance as a pivot into internal networks. SonicWall advised organizations to upgrade to fixed firmware, preserve logs, hunt for indicators of compromise, and treat exposed devices as potentially breached, with rebuilds or factory resets and credential rotation recommended where intrusion is suspected.
Aug 4, 2026