Threat Actor Deploys 'OVERSTEP' Backdoor in Ongoing SonicWall SMA Attacks

Threat actor UNC6148 is behind ongoing SonicWall SMA attacks, with researchersvtracking a “previously unknown” persistent backdoor called OVERSTEP that operates as a user-mode rootkit to maintain access, steal credentials and conceal activity. According to Google Threat Intelligence Group (GTIG), the campaign leverages credentials and one-time password seeds stolen in prior breaches, and UNC6148 may have used a zero-day remote code execution vulnerability to deploy OVERSTEP on SMA appliances.

The researchers flag several older and newer CVEs as having been exploitable in prior incidents, including CVE-2021-20038, CVE-2024-38475, CVE-2021-20035, CVE-2021-20039 and CVE-2025-32819. SonicWall has released a firmware update (10.2.2.2-92sv) to help remove the rootkit and enhance log integrity, cautioning that SMA 100 devices are reaching end-of-support on 1 October.

The advisory followed the MySonicWall cloud backup file incident, after which SonicWall’s investigation found malicious brute-force activity against the MySonicWall portal to obtain customer information.