Crims hijacking fully patched SonicWall VPNs to deploy stealthy backdoor and rootkit

Google Threat Intelligence Group attributes an active campaign (UNC6148) exploiting SonicWall SMA 100 appliances to deploy OVERSTEP, a previously unknown C-written backdoor and rootkit that modifies boot behavior for persistence, removes logs, and steals credentials, certificates and OTPs; investigators observed exploitation via known CVEs and possibly a zero-day, and assess the actors focus on data theft and extortion with potential for ransomware.