UNC6148 deploys Overstep malware on SonicWall devices, possibly for ransomware operations

Google’s Threat Intelligence Group attributes a campaign to UNC6148 that has deployed OVERSTEP — a sophisticated C-written user-mode rootkit/backdoor — against SonicWall SMA 100 series appliances since at least October 2024; the malware achieves persistent privileged access via /etc/ld.so.preload (locked immutable), injects into the initrd to survive reboots, hides forensic traces, enables remote shells and targeted data collection/exfiltration, and is associated with at least one May–June 2025 data leak and overlaps with prior Abyss/VSOCI activity, with published IoCs and YARA rules to aid detection.