SonicWall Secure Mobile Access Attack

A Google Threat Intelligence Group-identified campaign (attributed to UNC6148 with moderate confidence) is actively exploiting SonicWall SMA100 appliances—using multiple CVEs and likely a zero-day—to install a custom Linux rootkit named OVERSTEP that steals admin credentials and OTPs, persists across updates, manipulates logs, and connects outbound to command-and-control; organizations with affected SMA100 devices should investigate for compromise, rotate credentials, and perform deep forensic analysis.