Hackers Exploit End-of-Life SonicWall Appliances to Steal Sensitive Data

Google's Threat Intelligence Group (GTIG) and Mandiant have uncovered an ongoing campaign leveraging vulnerabilities in end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances to steal sensitive data. The threat actor, UNC6148, uses previously stolen credentials and OTP seeds to regain access even after security updates. A backdoor called OVERSTEP modifies the boot process for persistent access, credential theft, and malware concealment. While potentially linked to the Abyss ransomware gang, the attackers' motives and victim count remain unclear. SonicWall has released an update advising users to reset OTP bindings.