UNC6148

UNC6148 is a financially motivated threat actor tracked for sustained intrusions against SonicWall Secure Mobile Access (SMA) 100 series appliances, particularly fully patched but end-of-life devices. The group has been active since at least October 2024 and is associated with deployment of the OVERSTEP backdoor/rootkit on compromised SMA 100 appliances. Reporting also notes overlaps or associations with Abyss-related ransomware activity and with the World Leaks criminal ecosystem, but those relationships are not sufficiently established to treat them as formal aliases. UNC6148’s observed tradecraft centers on obtaining valid administrative credentials, including previously stolen credentials and one-time password material, establishing VPN sessions, and deploying OVERSTEP for stealthy persistence and privileged control of the appliance. OVERSTEP has been described as a persistent backdoor/rootkit that modifies the boot process or otherwise survives reboot, conceals components, removes or alters logs, establishes reverse-shell access, steals credentials and OTP seeds, and enables exfiltration of sensitive appliance data including certificate material and authentication databases. The actor has also been linked to exploitation of SonicWall SMA vulnerabilities including CVE-2024-38475 and CVE-2025-40599, and investigators assessed with moderate confidence that an unknown zero-day remote code execution vulnerability may also have been used in some intrusions. The actor’s behavior indicates strong capabilities in initial access, persistence, defense evasion, credential theft, session abuse, privilege acquisition on edge appliances, and follow-on post-exploitation. UNC6148 has been assessed as opportunistically targeting exposed SonicWall SMA appliances and likely using stolen data from those devices to support subsequent intrusions. Multiple reports characterize the activity as likely tied to data theft and extortion objectives rather than espionage.