SonicWall released a critical firmware update (version 10.2.2.2-92sv) to eliminate the OVERSTEP rootkit that compromises end-of-life SMA 100 devices. The malware, deployed by the UNC6148 group, maintains persistent access even after previous patches and can lead to ransomware attacks.
The rootkit was discovered by the Google Threat Intelligence Group in an active campaign by the UNC6148 group, which compromises SMA 100 devices even with previously updated security patches. The malware is highly sophisticated: modifies the boot process, maintains persistence through hidden components, establishes reverse shells, and steals credentials, OTP seeds, and certificates.
Recommendations:
- Apply immediate firmware update: Install firmware version 10.2.2.2-92sv on all SMA 100 devices immediately.
- Conduct forensic imaging: Acquire disk images for forensic analysis before remediation, with SonicWall support if necessary.
- Reset all credentials: Reset all credentials, including passwords and OTP bindings for all device users.
- Revoke and reissue certificates: Revoke and reissue certificates with private keys stored on the device.
- Search for compromise indicators: Look for indicators of compromise such as suspicious files, malicious web requests, and anomalous VPN sessions.
SEK is actively monitoring the case and remains available to assist its clients in implementing the necessary measures and analyzing potential compromise.
