SonicWall releases rootkit-busting firmware update following wave of attacks

SonicWall on Monday released a firmware update that the security vendor says will remove rootkit malware deployed in recent attacks targeting Secure Mobile Access (SMA) 100 appliances. The update comes about two months after Google warned that some unknown criminals have been exploiting fully patched, end-of-life SonicWall SMA 100 appliances to deploy a previously unknown backdoor and rootkit dubbed OVERSTEP. The malware modifies the appliance's boot process to maintain persistent access, enabling the criminals to steal sensitive credentials and conceal their own components. The Chocolate Factory's intel analysts in July attributed the ongoing campaign to UNC6148 - UNC in Google's threat-group naming taxonomy stands for "Uncategorized." In its Monday advisory, the security appliance maker pointed to Google's earlier threat report about UNC6148 targeting SMA 100 appliances and dropping the never-before-seen rootkit. "SonicWall strongly recommends that users of the SMA 100 series products (SMA 210, 410, and 500v) upgrade to the 10.2.2.2-92sv version," the vendor said. This rootkit-busting firmware update follows a series of other attacks targeting the firewall and VPN maker, whose products have been exploited in recent months for ransomware infections as well as credential- and data-stealing campaigns. Also on Monday, SonicWall and the US Cybersecurity and Infrastructure Security Agency (CISA) warned of brute-force attacks targeting its cloud backup service for firewalls, follo...