Overstep Backdoor Persists on End‑of‑Life SonicWall SMA Appliances, UNC6148
Google’s Threat Intelligence Group uncovered a campaign where UNC6148 hijacked admin credentials on fully patched, end‑of‑life SonicWall SMA‑100 devices and installed the custom OVERSTEP rootkit. The malware hides its files, deletes logs, and maintains persistence across reboots, enabling credential theft and further exploitation.