SonicWall Under Siege: Ransomware Through the SSL-VPN

SonicWall ships SonicOS firewalls with SSL-VPN and the SMA (Secure Mobile Access) 100-series remote-access appliances — both edge devices and prime initial-access targets. Two separate problems stand out: the critical access-control flaw CVE-2024-40766, leveraged by Akira and Fog ransomware affiliates through the SSL-VPN, and a campaign by the actor Google/Mandiant tracks as UNC6148 against end-of-life SMA 100 appliances using a stealthy rootkit named OVERSTEP. These are distinct clusters and should not be conflated.

CVE-2024-40766 and Ransomware

CVE-2024-40766 is an improper-access-control flaw in SonicOS management and SSL-VPN access (SonicWall advisory SNWLID-2024-0015), affecting Gen5/Gen6/Gen7 devices, disclosed around August 2024 and CISA KEV-listed; it is rated critical (sources cite CVSS 9.3, with one listing 9.8). Bitsight reported 100+ organisations compromised from September to December 2024. Arctic Wolf initially suspected a zero-day behind a spike in malicious SSL-VPN logins, then concluded Akira was leveraging CVE-2024-40766 together with weak or reused credentials and misconfiguration; SonicWall stated high confidence the activity was this CVE, not a new zero-day. Rapid7 reported abuse of an over-broad default LDAP group and the Virtual Office OTP portal, and Arctic Wolf observed logins succeeding against some MFA-protected accounts (an unconfirmed OTP-seed-compromise hypothesis). T1190 T1078 T1133

UNC6148 and the OVERSTEP Rootkit

Separately, Google/Mandiant reported UNC6148 (financially motivated, active since at least October 2024) exploiting end-of-life SMA 100 appliances and deploying OVERSTEP, a user-mode rootkit that modifies the boot process to persist and hide its components, linked to data-theft extortion and ransomware. Mandiant found the actors already holding local admin credentials and could not confirm the initial-access vector; candidate CVEs have been named (including an older SMA 100 flaw) but Mandiant could not confirm which was used and raised the possibility of an unknown zero-day. T1014

Detection & Mitigation

• Patch SonicOS to fixed builds; retire and replace end-of-life SMA 100 hardware rather than leaving it internet-facing.
• Rotate all credentials and reset OTP/TOTP seeds after patching — stolen credentials and OTP seeds enable re-compromise even on patched appliances.
• Tighten SSL-VPN access scoping: remove over-broad default LDAP group membership and apply least privilege; enforce MFA and investigate anomalous SSL-VPN logins (new geolocations, login bursts, successful logins on dormant accounts).
• On SMA 100, inspect for boot-process tampering per Mandiant’s OVERSTEP write-up and treat suspect appliances as fully compromised — reimage, do not just patch.