SonicWall has issued an urgent firmware update to help customers eliminate dangerous rootkit malware targeting their SMA 100 series network appliances. The new firmware version 10.2.2.2-92sv includes enhanced file checking capabilities specifically designed to detect and remove known rootkit infections.

## Immediate Action Required

The company strongly recommends that all users of SMA 100 series products—including models 210, 410, and 500v—upgrade immediately to the latest firmware version. This update is particularly critical as these devices are approaching end-of-support on October 1, 2025.

## The OVERSTEP Threat

The firmware update addresses a sophisticated malware campaign discovered by Google’s Threat Intelligence Group in July 2024. Researchers identified a threat actor known as UNC6148 deploying “OVERSTEP” malware on vulnerable SonicWall devices.

OVERSTEP is a particularly dangerous rootkit that:
– Maintains persistent access to compromised systems
– Uses hidden malicious components to avoid detection
– Establishes reverse shell connections for remote control
– Steals sensitive files including credentials and security certificates

## Connection to Ransomware Attacks

Security researchers have found concerning links between these attacks and Abyss ransomware incidents. Multiple cases from late 2023 and early 2024 showed similar compromise patterns where attackers used SMA devices as entry points for ransomware deployment.

## Broader Security Concerns

This incident is part of a series of recent SonicWall security issues:
– **Credential Exposure**: Last week, the company warned customers to reset passwords after firewall backup files were compromised in brute-force attacks
– **Akira Ransomware**: Ongoing exploitation of a critical vulnerability (CVE-2024-40766) by the Akira ransomware group, confirmed by Australian cybersecurity authorities

## Recommended Actions

Network administrators should:
1. **Update immediately** to firmware version 10.2.2.2-92sv
2. **Reset all credentials** as a precautionary measure
3. **Review security configurations** following SonicWall’s July advisory guidelines
4. **Monitor systems** for signs of compromise

This situation highlights the critical importance of maintaining current firmware versions and implementing comprehensive security monitoring, especially for network appliances approaching end-of-life status.