Zero-Day Vulnerability Exploited to Deploy Stealthy Overstep Backdoor

Researchers report an active campaign where attackers, likely tied to the Abyss ransomware group, exploit a probable zero-day in SonicWall SMA 100 series devices to gain SSL VPN access using harvested credentials, escalate privileges via a reverse shell, and deploy a stealthy 32-bit ELF user-mode rootkit called Overstep that hooks the dynamic linker and modifies the bootloader for persistent, hard-to-detect access; the campaign leverages prior CVEs and aligns with UNC6148 tactics, posing a high-risk, sophisticated threat to organizations.