The Persistent Threat of OVERSTEP Malware on SonicWall SMA 100 Devices

The Persistent Threat of OVERSTEP Malware on SonicWall SMA 100 Devices

Alex Cipher's Profile Pictire Alex Cipher 4 min read

A stealthy adversary has been lurking within the digital corridors of SonicWall SMA 100 devices: the OVERSTEP malware. Unlike typical threats, OVERSTEP operates as a user-mode rootkit, embedding itself so deeply that even firmware updates and device reboots struggle to shake it off. Its presence has enabled attackers to steal sensitive files—think credentials, OTP seeds, and certificates—turning trusted security appliances into launchpads for further attacks. The group behind this, UNC6148, has a notorious track record, including ties to the Abyss ransomware and a string of high-profile breaches. Notably, incidents in late 2023 and early 2024 saw attackers maintain persistence on compromised devices, even after supposed remediation (BleepingComputer).

What makes OVERSTEP especially dangerous is its exploitation of outdated firmware vulnerabilities, such as the critical CVE-2024-40766. The Google Threat Intelligence Group has highlighted the risks of lagging behind on updates, and SonicWall’s response—a firmware update with enhanced malware detection—underscores the urgency for organizations to stay vigilant and proactive (BleepingComputer).

The Threat: OVERSTEP Malware

Characteristics of OVERSTEP Malware

OVERSTEP is a sophisticated user-mode rootkit specifically targeting SonicWall SMA 100 devices. This malware is engineered to provide persistent access to compromised systems by embedding itself deeply within the operating environment. It achieves persistence through the utilization of hidden malicious components and the establishment of a reverse shell, which allows attackers to maintain access even if the device undergoes firmware updates or reboots. The malware is particularly insidious because it operates in user mode, making detection and removal more challenging compared to kernel-mode rootkits. (BleepingComputer)

Impact on SonicWall Devices

The deployment of OVERSTEP malware on SonicWall SMA 100 devices poses significant security risks. These devices, which include models such as the SMA 210, 410, and 500v, are critical components in many organizations’ network security infrastructure. The malware’s ability to steal sensitive files, including the persist database and certificate files, is particularly concerning. This theft provides attackers with access to credentials, OTP seeds, and certificates, which can be used to further entrench their presence within the network. The compromised devices not only serve as entry points for further attacks but also as platforms for launching attacks on other network components. (BleepingComputer)

Connection to UNC6148 and Abyss Ransomware

The threat actor known as UNC6148 has been identified as the primary perpetrator behind the deployment of OVERSTEP malware. This group has been linked to several high-profile ransomware incidents, most notably those involving Abyss ransomware. The connection between OVERSTEP and Abyss ransomware is underscored by the “noteworthy overlaps” observed by researchers. For instance, in late 2023, an investigation by Truesec revealed that hackers had installed a web shell on an SMA appliance, enabling them to maintain persistence despite firmware updates. This incident, along with similar compromises reported by InfoGuard AG in March 2024, highlights the ongoing threat posed by UNC6148 and their use of OVERSTEP as a tool for facilitating ransomware attacks. (BleepingComputer)

Vulnerabilities Exploited by OVERSTEP

The effectiveness of OVERSTEP malware is largely due to its exploitation of vulnerabilities in outdated firmware versions of SonicWall SMA 100 devices. The Google Threat Intelligence Group (GTIG) highlighted the potential risks associated with using older firmware versions, emphasizing the importance of keeping devices updated to mitigate these risks. The malware leverages these vulnerabilities to gain initial access to the device, after which it installs its components to ensure persistence. The critical vulnerability (CVE-2024-40766) patched in November 2024 is an example of such an exploited weakness, underscoring the need for timely updates and patches to prevent exploitation. (BleepingComputer)

Mitigation Strategies and Firmware Updates

In response to the threat posed by OVERSTEP malware, SonicWall has released a firmware update designed to remove known rootkit malware from SMA 100 devices. The 10.2.2.2-92sv build includes additional file-checking capabilities that can detect and eliminate the malware’s components. SonicWall strongly recommends that users of the affected devices upgrade to this version to protect their systems. Additionally, the company has advised customers to reset credentials following a breach that exposed firewall configuration backup files. These measures, along with the implementation of security practices outlined in the July advisory, are critical for mitigating the threat posed by OVERSTEP and ensuring the integrity of network security infrastructure. (BleepingComputer)

Final Thoughts

The saga of OVERSTEP malware is a stark reminder that even the most trusted security devices can become liabilities if not properly maintained. SonicWall’s swift release of a firmware update, complete with rootkit-wiping capabilities, demonstrates the importance of rapid response and layered defense. For organizations, the lesson is clear: regular updates, credential resets, and adherence to best practices are non-negotiable in the fight against sophisticated threats like UNC6148 and their ransomware campaigns. As attackers continue to innovate, so too must defenders—leveraging timely intelligence, robust patch management, and a healthy dose of skepticism toward anything that seems out of place on the network (BleepingComputer).

References

Related Articles