UNC6148 is a financially motivated threat actor targeting SonicWall appliances with the OVERSTEP backdoor.
Analyst brief
UNC6148 is a financially motivated threat actor targeting SonicWall Secure Mobile Access 100 series appliances. The group leverages stolen credentials and likely zero-day exploits to deploy a persistent backdoor called OVERSTEP, utilizing a kernel-level rootkit for stealth. Key TTPs include establishing SSL VPN sessions for reverse shells, credential theft, data exfiltration, and modifying legitimate scripts to maintain persistence. Defenders should prioritize monitoring for reused OTP seeds, anomalous SSL VPN logins, and unauthorized modifications to system files, especially legitimate scripts.
UNC6148
unknown
UNC6148 is a financially motivated threat actor that targets SonicWall Secure Mobile Access 100 series appliances, leveraging stolen credentials and possibly zero-day exploits to deploy a persistent backdoor known as OVERSTEP. They utilize a kernel-level rootkit for stealthy access and have been observed establishing SSL VPN sessions to launch reverse shells and manipulate system files. The actor's operations include credential theft, data exfiltration, and potential ransomware deployment, with evidence suggesting they modify legitimate scripts to maintain persistence. Their activities are characterized by the reuse of OTP seeds and admin credentials, allowing continued access even after security patches are applied.
What is the name of the persistent backdoor deployed by the UNC6148 actor?+
The persistent backdoor deployed by UNC6148 is called OVERSTEP.
What indicators should defenders monitor to detect UNC6148 activity?+
Defenders should prioritize monitoring for reused MFA OTP seeds, anomalous SSL VPN logins, and unauthorized modifications to system files, especially legitimate scripts.