Hackers Use Backdoor to Steal Data From SonicWall Appliance

A cybercrime group used a backdoor in a fully patched SonicWall appliance to steal credentials and may have sold the stolen data to ransomware groups as part of an ongoing campaign, Google Threat Intelligence Group found.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

The company attributed the campaign to a cybercrime group it tracks as UNC6148. The campaign, which began in January, is targeting end-of-life SonicWall Secure Mobile Access 100 series – a secure remote access appliance – using a previously unseen rootkit called OVERSTEP.

“We assess with high confidence that UNC6148 exploited a known vulnerability to steal administrator credentials prior to the targeted SMA appliance being updated to the latest firmware version,” Google said. “UNC6148 may have initially exfiltrated these credentials from the SMA appliance as early as January 2025.”

Operations tied to the latest campaign may have begun in October last year. Based on information regarding SonicWall flaws exploited since then, Google assesses UNC6148 may have exploited:

• CVE-2021-20038: An unauthenticated stack-based buffer overflow vulnerability. SonicWall patched the flaw in 2021 (see: SonicWall SMA 100 Series Users Urged to Apply Latest Fix).
• CVE-2024-38475: Unauthenticated path traversal vulnerability in Apache HTTP Server that allows hackers to map URLs to filesystem locations. SonicWall reported that the vulnerability was exploited by hackers in May.
• CVE-2021-20035 and CVE-2021-20039: Improper neutralization flaws in the SMA100 management interface.
• CVE-2025-32819: Is a privilege escalation flaw that allows attackers to bypass the path traversal checks to permit reboot of factory default settings.

Since exploitation of these flaws are only possible with a certain level of access to the SMA appliance, Google suspects hackers may have gained initial access through infostealer logs or credential marketplaces. It’s also likely that they exploited other vulnerabilities not identified by Google, the company said.

After gaining initial access, UNC6148 establishes a secure sockets layer virtual private network session on the targeted SMA 100 series appliance. The attacker then deploys a reverse shell on the targeted device to conduct initial reconnaissance and file manipulation using built-in binaries.

To ensure continued operation, the threat actor is likely using an offline-exported file to create a new network pathway, Google said. The hackers then deploy OVERSTEP backdoor to a configuration file to establish persistence.

“The changes meant that whenever the appliance was rebooted, the OVERSTEP binary would be loaded into the running filesystem on the appliance,” Google said.

Specifically, the hackers are modifying the boot Current Firmware function in the rc.fwboot script to unpack and repack the INITRD image file for injecting a malicious file. The file is then executed in the boot sequence, making its detection harder.

The malware then proceeds to remove modified files and other changes made, which offer further advanced stealth capabilities. In the next stage of the attack, the backdoor hijacks API functions for credentials, one-time password tokens and certificates.

“OVERSTEP is customized to specifically function on the SMA’s custom filesystem layout, and filter out logging activity to help cover their tracks,” said Zander Work, senior security engineer at Google Threat Intelligence Group. “This type of customization is not something GTIG typically observes from the majority of groups. We believe UNC6148 may have developed OVERSTEP as early as 2023,” he said.

Little is known about the threat actor, but Google says the stolen credentials might be used for data extortion or ransomware deployment. Based on malware infrastructure overlap, Google notes the malware was likely used by Abyss ransomware, which targeted SonicWall SMA in 2023. The hackers exploited CVE-2021-20038 and CVE-2021-20039.

SonicWall did not immediately respond to a request for comment. Its devices have been prone to multiple attacks in recent months.

In June, SonicWall disclosed that hackers were using a fake version of its NetExtender software for spread malware. Last year, researchers uncovered 25,000 SonicWall SSLVPN devices running on outdated series 7 firewall, exposing them to potential hacks (see: Critical Flaws Expose 25,000 SonicWall Devices to Hackers).

Google recommends SonicWall customers check for potential compromise, isolate affected appliances, reset all credentials and revoke and reissue any certificates with private keys.