Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit

July 16, 2025 TH Author

Unknown miscreants are exploiting fully patched, end-of-life SonicWall VPNs to deploy a previously unknown backdoor and rootkit, likely for data theft and extortion, according to Google’s Threat Intelligence Group.

In research published on Wednesday, the Chocolate Factory’s intel analysts attribute the ongoing campaign to UNC6148 – UNC in Google’s threat-actor naming taxonomy stands for “Uncategorized.” They appear to be using a backdoor rootkit dubbed OVERSTEP.

Once the miscreants compromised the SonicWall appliances, they deployed a previously unknown backdoor written in C. The malware modified the appliance’s boot process to maintain persistent access, enabling the criminals to steal sensitive credentials and conceal their own components.

The researchers assess “with high confidence” that the criminals are abusing previously stolen credentials and one-time password seeds, which allow them to maintain access to the compromised SonicWall Secure Mobile Access (SMA) 100 series appliances even after organizations have patched the buggy VPNs.

How the attack works

Mandiant, Google’s incident response arm, investigated one of the intrusions connected with this UNC6148 campaign, and determined that in June the crew established an SSL-VPN session on the SonicWall gear using local administrator credentials.

“Mandiant’s first observations of UNC6148 in a recent investigation showed that they already had local administrator credentials to the targeted SMA 100 series appliance, and no forensic evidence nor other data was identified to show how those credentials were obtained,” according to the report.

Additionally, there’s not much visibility into the attackers’ initial infection vector because the malware selectively removes log entries.

However, the Googlers say they most likely exploited known vulnerabilities including: CVE-2021-20038, CVE-2024-38475, CVE-2021-20035, CVE-2021-20039, or CVE-2025-32819.

Or they may have used a zero-day: “GTIG assesses with moderate confidence that UNC6148 may have used an unknown, zero-day remote code execution vulnerability to deploy OVERSTEP on targeted SonicWall SMA appliances,” according to the threat hunters.

After establishing an SSL-VPN session, UNC6148 spawned a reverse shell on the compromised appliance — even though this should not be possible because of the SMA 100 series’ firmware.

Neither Mandiant nor SonicWall’s Product Security Incident Response Team could determine how the attacker established the reverse shell, but Google said “it’s possible” they exploited an unknown security flaw.

After establishing the reverse shell, the miscreants can use the attack code to conduct initial reconnaissance and set new network access control policy rules to allow IP addresses used by UNC6148.

Then they installed OVERSTEP, manually cleared the system logs, and restarted the appliance to activate the backdoor. To achieve persistence, UNC6148 modified a legitimate run command file so that whenever the appliance rebooted, the malware would load and execute, thus ensuring the attackers maintained admin-level privileges and full access.

In addition to establishing a reverse shell and its rootkit capabilities, OVERSTEP also allows the criminals to steal passwords, security certificates, and OTPs from the compromised appliance.

“In our investigations, GTIG observed beaconing traffic from compromised appliances, but we did not identify notable post-compromise activities,” the report notes, adding that the attackers “success in hiding their tracks is largely due to OVERSTEP’s capability to selectively delete log entries from httpd.log, http_request.log, and inotify.log.”

A Google spokesperson told The Register the number of known victims is “limited,” and urged businesses that use these SonicWall devices to analyze them for signs of compromise, especially if they are vulnerable to any of the earlier known CVEs, following the steps outlined in the “Hunting and Detection” section of the technical analysis. This lists several indicators of compromise and other artifacts to help defenders find — and boot off — OVERSTEP on their systems.

Ransomware? It’s not off the table…

UNC6148 has been active since at least October 2024, and Google asserts “with moderate confidence” that its operations focus on data theft, extortion, and possibly ransomware.

“An organization targeted by UNC6148 in May 2025 was posted to the World Leaks data-leak site in June 2025, and UNC6148 activity overlaps with publicly reported SonicWall exploitation from late 2023 and early 2024 that has been publicly linked to the deployment of Abyss-branded ransomware (tracked by GTIG as VSOCIETY),” the researchers noted.

While the biggest risk to organizations comes from OVERSTEP’s capabilities to steal sensitive files, the Googlers note that they “did not directly observe the weaponization of this stolen data.” However, they add, it “creates a clear path for persistent access,” and as such, any compromised organizations should get rid of all secrets stored on infected appliances ASAP. ®