{"id":58983,"date":"2025-07-16T14:00:10","date_gmt":"2025-07-16T14:00:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/"},"modified":"2025-07-16T14:00:10","modified_gmt":"2025-07-16T14:00:10","slug":"crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/","title":{"rendered":"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit"},"content":{"rendered":"<p>Unknown miscreants are exploiting fully patched, end-of-life SonicWall VPNs to deploy a previously unknown backdoor and rootkit, likely for data theft and extortion, according to Google&#8217;s Threat Intelligence Group.<\/p>\n<p>In research published on Wednesday, the Chocolate Factory&#8217;s intel analysts attribute the ongoing campaign to UNC6148 &#8211; UNC in Google&#8217;s threat-actor naming taxonomy stands for &#8220;Uncategorized.&#8221;&nbsp;They appear to be using a backdoor rootkit dubbed OVERSTEP.<\/p>\n<p>Once the miscreants compromised the SonicWall appliances, they deployed a previously unknown backdoor written in C. The malware modified the appliance&#8217;s boot process to maintain persistent access, enabling the criminals to steal sensitive credentials and conceal their own components.&nbsp;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>The researchers assess &#8220;with high confidence&#8221; that the criminals are abusing previously stolen credentials and one-time password seeds, which allow them to maintain access to the compromised SonicWall Secure Mobile Access (SMA) 100 series appliances even after organizations have patched the buggy VPNs.<\/p>\n<h3 class=\"crosshead\">How the attack works<\/h3>\n<p>Mandiant, Google&#8217;s incident response arm, investigated one of the intrusions connected with this UNC6148 campaign, and determined that in June the crew established an SSL-VPN session on the SonicWall gear using local administrator credentials.<\/p>\n<p>&#8220;Mandiant&#8217;s first observations of UNC6148 in a recent investigation showed that they already had local administrator credentials to the targeted SMA 100 series appliance, and no forensic evidence nor other data was identified to show how those credentials were obtained,&#8221; according to the <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/blog\/topics\/threat-intelligence\/sonicwall-secure-mobile-access-exploitation-overstep-backdoor\">report<\/a>.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>Additionally, there&#8217;s not much visibility into the attackers&#8217; initial infection vector because the malware selectively removes log entries.&nbsp;<\/p>\n<p>However, the Googlers say they most likely exploited known vulnerabilities including: <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2022\/01\/11\/sonicwall_multiple_vulns\/\">CVE-2021-20038<\/a>, <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/05\/04\/security_news_in_brief\/\">CVE-2024-38475<\/a>, <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/04\/22\/security_news_in_brief\/\">CVE-2021-20035<\/a>, <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2022\/01\/11\/sonicwall_multiple_vulns\/\">CVE-2021-20039<\/a>, or <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/05\/12\/doge_cyber_experts_creds_found\/\">CVE-2025-32819<\/a>.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Or they may have used a zero-day: &#8220;GTIG assesses with moderate confidence that UNC6148 may have used an unknown, zero-day remote code execution vulnerability to deploy OVERSTEP on targeted SonicWall SMA appliances,&#8221; according to the threat hunters.<\/p>\n<p>After establishing an SSL-VPN session, UNC6148 spawned a reverse shell on the compromised appliance \u2014&nbsp;even though this should not be possible because of the SMA 100 series&#8217; firmware.<\/p>\n<p>Neither Mandiant nor SonicWall&#8217;s Product Security Incident Response Team could determine how the attacker established the reverse shell, but Google said &#8220;it&#8217;s possible&#8221; they exploited an unknown security flaw.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>After establishing the reverse shell, the miscreants can use the attack code to conduct initial reconnaissance and set new network access control policy rules to allow IP addresses used by UNC6148.<\/p>\n<p>Then they installed OVERSTEP, manually cleared the system logs, and restarted the appliance to activate the backdoor. To achieve persistence, UNC6148 modified a legitimate run command file so that whenever the appliance rebooted, the malware would load and execute, thus ensuring the attackers maintained admin-level privileges and full access.<\/p>\n<p>In addition to establishing a reverse shell and its rootkit capabilities, OVERSTEP also allows the criminals to steal passwords, security certificates, and OTPs from the compromised appliance.<\/p>\n<p>&#8220;In our investigations, GTIG observed beaconing traffic from compromised appliances, but we did not identify notable post-compromise activities,&#8221; the report notes, adding that the attackers &#8220;success in hiding their tracks is largely due to OVERSTEP&#8217;s capability to selectively delete log entries from httpd.log, http_request.log, and inotify.log.&#8221;<\/p>\n<p>A Google spokesperson told <em>The Register<\/em> the number of known victims is &#8220;limited,&#8221; and urged businesses that use these SonicWall devices to analyze them for signs of compromise, especially if they are vulnerable to any of the earlier known CVEs, following the steps outlined in the &#8220;Hunting and Detection&#8221; section of the technical analysis. This lists several indicators of compromise and other artifacts to help defenders find \u2014 and boot off \u2014 OVERSTEP on their systems.<\/p>\n<h3 class=\"crosshead\">Ransomware? It&#8217;s not off the table\u2026<\/h3>\n<p>UNC6148 has been active since at least October 2024, and Google asserts &#8220;with moderate confidence&#8221; that its operations focus on data theft, extortion, and possibly ransomware.<\/p>\n<p>&#8220;An organization targeted by UNC6148 in May 2025 was posted to the World Leaks data-leak site in June 2025, and UNC6148 activity overlaps with <a target=\"_blank\" href=\"https:\/\/www.truesec.com\/hub\/blog\/web-shell-on-a-sonicwall-sma\" rel=\"nofollow\">publicly reported SonicWall exploitation<\/a> from late 2023 and early 2024 that has been <a target=\"_blank\" href=\"https:\/\/dfir.ch\/posts\/microsocks_sonicwall\/\" rel=\"nofollow\">publicly linked<\/a> to the deployment of Abyss-branded ransomware (tracked by GTIG as VSOCIETY),&#8221; the researchers noted.<\/p>\n<p>While the biggest risk to organizations comes from OVERSTEP&#8217;s capabilities to steal sensitive files, the Googlers note that they &#8220;did not directly observe the weaponization of this stolen data.&#8221; However, they add, it &#8220;creates a clear path for persistent access,&#8221; and as such, any compromised organizations should get rid of all secrets stored on infected appliances ASAP. \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2025\/07\/16\/sonicwall_vpn_hijack\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Someone&#8217;s OVERSTEPing the mark Unknown miscreants are exploiting fully patched, end-of-life SonicWall VPNs to deploy a previously unknown backdoor and rootkit, likely for data theft and extortion, according to Google&#8217;s Threat Intelligence Group.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-58983","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-16T14:00:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit\",\"datePublished\":\"2025-07-16T14:00:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/\"},\"wordCount\":759,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/\",\"name\":\"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2025-07-16T14:00:10+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/","og_locale":"en_US","og_type":"article","og_title":"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2025-07-16T14:00:10+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit","datePublished":"2025-07-16T14:00:10+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/"},"wordCount":759,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/","url":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/","name":"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2025-07-16T14:00:10+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/research&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aHe6hFvkOEvwsxjHfGaZpQAAAY0&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/crims-hijacking-fully-patched-sonicwall-vpns-to-deploy-stealthy-backdoor-and-rootkit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/58983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=58983"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/58983\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=58983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=58983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=58983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}