UNC6148 Exploits Fully Patched SonicWall SMA 100 Firewalls with Persistent OVERSTEP Rootkit, Google Links Attack to Ransomware

Cybersecurity researchers have identified a sophisticated attack targeting fully patched SonicWall SMA 100 series firewalls. The attack involves the deployment of a stealthy backdoor and rootkit named OVERSTEP, which is capable of rewriting boot scripts, hiding logs, and stealing credentials. This malware persists even after device reboots, allowing attackers to maintain long-term access. The threat actor UNC6148 is linked to these intrusions, which have been associated with ransomware activities. Google has publicly disclosed the discovery of this custom backdoor, highlighting the severity of the compromise on SonicWall network devices despite recent patches.