Google uncovers tailored backdoor malware targeting SonicWall appliances

Google’s Threat Intelligence Group (GTIG) and Mandiant have discovered a sophisticated cyberattack targeting end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances. The attackers have been exploiting stolen credentials and one-time password (OTP) seeds, allowing them to access organizations even after security updates have been applied. This attack utilizes a custom malware backdoor, known as OVERSTEP, which modifies the boot process of the affected appliances to maintain persistent access. The malware’s ability to delete log entries makes tracking its origin difficult. SonicWall has confirmed other organizations have been affected, and has advised customers to reset OTP bindings to mitigate risks. In addition to the known vulnerabilities, experts suspect the attackers may have also used a previously unknown zero-day vulnerability to deploy the malware. The discovery highlights the risks associated with end-of-life devices that no longer receive updates or support.