Fast Facts

• SonicWall released firmware update 10.2.2.2-92sv to remove rootkit malware from SMA 100 series devices.
• Google’s Threat Intelligence Group linked recent attacks to a threat actor called UNC6148 using OVERSTEP malware.
• OVERSTEP is a rootkit that helps attackers hide, persist, and steal sensitive credentials from devices.
• Some SonicWall devices are reaching end-of-life, raising security risks for unpatched systems.
• Past ransomware incidents, including those involving Abyss and Akira gangs, show a pattern of targeting SonicWall vulnerabilities.

Shadow Games: Malware Hides While Defenders Scramble

Imagine a locked vault where the thief has not only stolen the key, but left behind a hidden trapdoor for future heists. That’s the reality SonicWall and its customers face as rootkit malware burrows deep into their network appliances, evading detection and opening doors for cybercriminals. The recent release of SonicWall’s new firmware is not just a patch; it’s a digital cleansing ritual, aiming to flush out the persistent malware that has haunted their SMA 100 series devices.

The saga began to intensify in July, when researchers from Google’s Threat Intelligence Group (GTIG) spotted a sophisticated adversary, dubbed UNC6148, exploiting aging SonicWall devices. Their weapon of choice: OVERSTEP, a user-mode rootkit designed to remain invisible while siphoning off credentials, certificates, and other digital valuables. These attacks specifically targeted devices on the brink of end-of-support, a period when vendors typically stop issuing fixes, effectively leaving doors unlocked for attackers.

Déjà Vu: Old Devices, New Attacks

This is not SonicWall’s first brush with malware lurking in the digital woodwork. Over the past year, incident responders like Truesec and InfoGuard AG have chronicled cases where attackers piggybacked on outdated firmware, installing web shells-secret passageways that survive even software upgrades. These footholds were linked to Abyss ransomware, a criminal operation that specializes in encrypting and extorting organizations. The pattern is clear: attackers love neglected devices, and they don’t mind getting creative to persist through defensive measures.

Recent warnings from SonicWall and cybersecurity agencies underscore the urgency. Not only have rootkits like OVERSTEP been found, but other ransomware gangs-such as Akira-have exploited separate vulnerabilities (like CVE-2024-40766) to breach unpatched devices. The market’s reliance on these appliances, combined with the slow pace of hardware renewal, creates a lucrative hunting ground for cybercriminals who thrive on technical debt.

Firmware as a Firewall: The Battle Continues

SonicWall’s latest update does more than fix a bug-it actively scans for and removes lurking malware, giving administrators a fighting chance. Yet, the company’s repeated advisories to reset credentials and update promptly reveal the scale of the challenge. With some devices approaching end-of-life, organizations face a tough choice: patch up and hope for the best, or invest in new hardware before attackers strike again.

The story of SonicWall’s rootkit battle is a stark reminder: in the digital underworld, the shadows are never empty, and the only way to stay safe is through vigilance, timely updates, and a healthy skepticism of anything left unchecked for too long.

WIKICROOK

• Rootkit: A rootkit is stealthy malware that hides itself on a device, allowing attackers to secretly control the system and evade detection.
• Firmware: Firmware is specialized software stored in hardware devices, managing their core operations and security, and enabling them to function properly.
• Reverse Shell: A reverse shell is when a hacked computer secretly connects back to an attacker, giving them remote control and bypassing standard security defenses.
• End: End-to-end encryption is a security method where only the sender and recipient can read messages, keeping data private from service providers and hackers.
• Web Shell: A web shell is a malicious script uploaded to a server by hackers, allowing them to control the server remotely via a web interface.