Loading malware…
OVERSTEP is a custom persistent backdoor and rootkit used in intrusions against SonicWall Secure Mobile Access (SMA) 100 series appliances, including SMA 210, SMA 410, and SMA 500v. It has been associated with the financially motivated threat actor UNC6148 and has been observed on fully patched but end-of-life SMA 100 devices.
The malware is described across reporting as a stealthy user-mode rootkit and persistent backdoor; some reporting also characterizes it as kernel-level. Its core function is to provide long-term privileged control of compromised appliances while concealing attacker activity. OVERSTEP modifies the appliance boot process for persistence, hides malicious components, can remove or obscure log evidence, and enables operators to regain access even after partial remediation if stolen authentication material remains valid.
Operationally, OVERSTEP supports administrator-level control, reverse shell access, command execution, installation of additional backdoors, and theft of sensitive data from the appliance. Reported theft includes credentials, session tokens, one-time password seeds, certificates, and appliance database material used for authentication and follow-on access. This makes the malware particularly dangerous on remote-access infrastructure, where compromise can facilitate continued access to enterprise environments and downstream intrusion activity.
Observed deployment has been tied to exploitation of SonicWall SMA 100 vulnerabilities, including CVE-2024-38475 and CVE-2025-40599, and some assessments indicate UNC6148 may also have used an unknown remote code execution vulnerability in opportunistic targeting. The campaign has targeted internet-facing VPN and secure access appliances, and reporting notes possible overlap between UNC6148 activity and ransomware-related operations. SonicWall later released firmware intended to detect and remove known OVERSTEP infections from affected SMA 100 devices.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Hackerská skupina UNC6148 zneužívala zraniteľnosti webového servera Apache CVE-2024-38475 a SMA 100 CVE-2025-40599 na šírenie rootkitu OVERSTEP. | Hackerská skupina UNC6148 aktívne zneužívala kritické zraniteľnosti CVE-2024-38475, CVE-2025-40599 na infekciu rootkitom OVERSTEP. Malware zabezpečoval perzistentný prístup, vytváral reverzný shell a exfiltroval citlivé údaje ako persist.database, certifikáty, prihlasovacie údaje a OTP seedy.
Hackerská skupina UNC6148 zneužívala zraniteľnosti webového servera Apache CVE-2024-38475 a SMA 100 CVE-2025-40599 na šírenie rootkitu OVERSTEP. | Hackerská skupina UNC6148 aktívne zneužívala kritické zraniteľnosti CVE-2024-38475, CVE-2025-40599 na infekciu rootkitom OVERSTEP. Malware zabezpečoval perzistentný prístup, vytváral reverzný shell a exfiltroval citlivé údaje ako persist.database, certifikáty, prihlasovacie údaje a OTP seedy.
SonicWall’s internal investigation attributes these incidents to exploitation of the known vulnerability CVE-2024–40766. Although SonicWall released a security patch for this issue in August 2024, attackers are still leveraging credentials that were stolen at the time of those incidents.
...CVE-2021-20035 and CVE-2021-20039, authenticated remote code execution vulnerabilities; | "Now, the threat actor is deploying what the researchers describe as a 'previously unknown persistent backdoor/user-mode rootkit' which they are tracking as OVERSTEP."
...and CVE-2025-32819, an authenticated file deletion vulnerability. | "Now, the threat actor is deploying what the researchers describe as a 'previously unknown persistent backdoor/user-mode rootkit' which they are tracking as OVERSTEP."
Google TAG researchers noted that there are several vulnerabilities that could have been exploited by UNC6148 in the past, including CVE-2021-20038, a memory corruption vulnerability; | "Now, the threat actor is deploying what the researchers describe as a 'previously unknown persistent backdoor/user-mode rootkit' which they are tracking as OVERSTEP."
...CVE-2021-20035 and CVE-2021-20039, authenticated remote code execution vulnerabilities; | "Now, the threat actor is deploying what the researchers describe as a 'previously unknown persistent backdoor/user-mode rootkit' which they are tracking as OVERSTEP."
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Hackerská skupina UNC6148 aktívne zneužívala kritické zraniteľnosti CVE-2024-38475, CVE-2025-40599 na infekciu rootkitom OVERSTEP. Malware zabezpečoval perzistentný prístup, vytváral reverzný shell a exfiltroval citlivé údaje ako persist.database, certifikáty, prihlasovacie údaje a OTP seedy.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rootkit malware previously deployed in attacks targeting SonicWall SMA 100 series devices.
Referenced only in related-content material as rootkit malware affecting SonicWall SMA devices.
Rootkit/backdoor deployed on fully-patched SonicWall SMA 100 series appliances to maintain persistent access (per summary).
Custom rootkit malware reportedly installed on compromised systems after exploitation of end-of-life SonicWall SMA 100 devices, likely to provide stealthy persistence and privileged access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.