Fully Patched SonicWall Gear Under Likely Zero-Day Attack

GTIG observed an active campaign (UNC6148) compromising SonicWall SMA 100 series devices — likely using stolen local admin credentials and one or more unpatched vulnerabilities — to install a novel persistent user-mode rootkit/backdoor called Overstep. The backdoor modifies the appliance boot process to maintain persistence, hide components, and exfiltrate credentials; activity is linked to the Abyss ransomware cluster and may have been ongoing since October 2024. Organizations with affected devices are advised to perform forensic disk analysis, hunt for compromises, and rotate credentials.