Listen to this Post
A Silent Cyber Siege: The New Face of Network Infiltration
Google’s Threat Intelligence Group (GTIG) has uncovered a dangerous, highly sophisticated malware campaign targeting SonicWall SMA 100 series appliances. The attacker, identified as UNC6148, has been active since at least October 2024 and is deploying a new rootkit/backdoor hybrid malware named OVERSTEP. This stealthy threat allows attackers to maintain long-term access to corporate networks with alarming persistence and invisibility.
Despite the absence of confirmed financial motives, indicators point to serious risks: data theft, extortion, and potential ransomware attacks. The malware uses advanced techniques to hide its presence, including anti-forensic mechanisms and hijacked system functions. Most worryingly, UNC6148 has managed to regain access to patched systems using credentials and OTP seeds stolen in prior breaches—making traditional security updates insufficient in stopping them.
The malware’s capabilities include:
Hiding itself from system administrators.
Capturing sensitive system data.
Launching covert remote sessions.
Enabling full system compromise.
GTIG believes a zero-day Remote Code Execution (RCE) exploit may have been used to install OVERSTEP, though definitive proof is obscured by log-cleansing operations executed by the attackers. UNC6148’s activities bear resemblance to previous incidents involving the Abyss/VSOCIETY ransomware operations, suggesting this campaign could evolve into more financially driven extortion tactics.
Google’s investigation has led to public disclosure of indicators of compromise (IoCs) and YARA rules to aid in detection, but remediation requires in-depth forensic analysis—and in many cases, cooperation with SonicWall.
🔍 the Original
Since October 2024, threat actor UNC6148 has been attacking SonicWall SMA appliances using a new malware strain called OVERSTEP. This malware, a combination of a user-mode rootkit and a backdoor, allows attackers to hijack processes, hide from detection, and maintain persistent access. Google reports the group is likely exploiting stolen credentials and OTP seeds from earlier breaches to re-enter systems even after updates have been applied.
In a May 2025 case, UNC6148 used stolen admin credentials to access a SonicWall appliance and initiate a reverse shell—likely via an unknown exploit. From there, the group explored the system, changed configurations, and deployed OVERSTEP by modifying key files like /etc/ld.so.preload and boot scripts, ensuring the rootkit would load every time the device restarts. They also used timestomping and anti-forensic tactics to remove their traces.
OVERSTEP is designed in C, targets Intel x86 architecture, and is stealthy enough to evade standard detection. It hijacks core functions (like write, open, readdir) and hides logs, processes, and its own presence. Commands sent via disguised web traffic include launching reverse shells and archiving system data into public directories for easy exfiltration. Once installed, OVERSTEP becomes deeply embedded, nearly impossible to remove without physical intervention.
Google links this activity to earlier Abyss ransomware campaigns and warns that although they haven’t observed direct monetization yet, evidence points to a trajectory toward extortion and ransomware. They advise full disk image capture and forensic analysis to detect infection.
💬 What Undercode Say:
The OVERSTEP malware campaign represents a major leap in targeted appliance attacks, and it exposes a chilling reality: firmware-level persistence and credential-based lateral movement are the new normal in cyber warfare.
What makes this campaign especially threatening isn’t just the complexity of the malware, but the calculated patience and precision of UNC6148. They’re not operating like spray-and-pray ransomware crews. They are surgical, deliberate, and stealthy—more akin to state-sponsored APTs than ordinary cybercriminals.
The use of /etc/ld.so.preload for persistence is a clever, low-level trick—it’s a file meant to preload shared libraries for all processes. By inserting themselves here, OVERSTEP guarantees every process spawns under their control. And when paired with FS_IMMUTABLE_FL, attackers make that file virtually untouchable—even for sysadmins.
Furthermore, the hijacking of library functions like write() is not just stealthy—it’s weaponized observability. Attackers can inspect log buffers in real time, respond with embedded commands, and then erase their digital footsteps. This effectively renders traditional logging tools useless.
What’s perhaps most concerning is that organizations may believe they’re safe after patching known CVEs—but UNC6148 re-enters systems through recycled credentials and harvested OTP seeds, a move that mocks even the most diligent IT teams. That’s a glaring reminder: security is not just patching systems; it’s monitoring for behavioral anomalies long after the initial compromise.
The link to Abyss/VSOCIETY ransomware isn’t just speculative. It signals a shift from silent espionage to outright data extortion at scale, potentially with delayed payload activation—an attacker could wait months, quietly harvesting credentials, before launching a full ransomware strike.
SonicWall users, in particular, are sitting on a ticking time bomb if they haven’t conducted deep forensic scans. The GTIG recommendation to image full disks, especially via SonicWall support, underscores how traditional incident response isn’t enough. Anti-rootkit tools won’t help here. Affected organizations need kernel-level inspection, memory analysis, and external auditing to ensure complete removal.
If OVERSTEP becomes modular—and there’s evidence it’s evolving from previous tools like wafxSummary—we may soon see variants targeting other vendors in the remote access appliance market: Fortinet, Cisco, even VMware.
UNC6148’s activity is a textbook example of how infrastructure-layer malware is bypassing endpoint detection and antivirus completely. This isn’t about tricking users into clicking links. This is war in the firmware trenches.
🔍 Fact Checker Results:
✅ Google GTIG’s report and technical IOCs match with multiple independent sources, including Truesec and dfir.ch
✅ CVE-2024-38475 is a real, SonicWall-acknowledged vulnerability with historical links to past breaches
✅ OVERSTEP’s rootkit behavior (FS_IMMUTABLE_FL, preload hijacking) has precedent in advanced Linux malware
📊 Prediction:
Expect OVERSTEP to spawn new variants targeting remote access appliances across multiple vendors. Within 6–12 months, we may see:
Modular dropper versions with ransomware payloads
Phishing campaigns exploiting credentials stolen via OVERSTEP
Public leaks of high-profile VPN credentials leading to extortion-as-a-service offerings
Vendors like SonicWall will be forced to implement immutable hardware root-of-trust firmware validation, and enterprise security teams will increasingly rely on firmware integrity validation rather than just endpoint tools. A paradigm shift is already underway—OVERSTEP is merely the warning shot.
References:
Reported By: securityaffairs.com
Extra Source Hub:
https://www.stackexchange.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
