SonicWall Updates SMA 100 Appliances to Remove Overstep Malware

SonicWall has released a fresh software update for its SMA 100 appliances to help users remove the Overstep malware deployed in a recent campaign, with the update introducing additional file checks and the capability to remove the known rootkit present on SMA devices.

The release comes after Google’s Threat Intelligence Group flagged the campaign in July, which involved a threat actor tracked as UNC6148 infecting fully patched SMA appliances with a persistent backdoor and a user‑mode rootkit that facilitates credential, session token, and one‑time password seed theft. The update, SMA 100 software version 10.2.2.2-92sv, affects all SMA 210, 410, and 500v appliances running 10.2.1.15-81sv and earlier software versions.

SonicWall also urges organisations using SMA 100 series appliances to review and implement security steps outlined in its July advisory, as part of ongoing mitigations alongside broader actions such as monitoring indicators of compromise released by Google in July. Separately, the firm has announced it will deactivate all SMA100 appliances on 31 October 2025, prompting customers to migrate to alternative SonicWall solutions before that date.