Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor | Google Cloud Blog

A financially motivated threat actor is actively exploiting SonicWall SMA 100 series appliances—despite patches—by leveraging previously stolen credentials and deploying a stealthy, persistent rootkit dubbed OVERSTEP, enabling ongoing access, credential theft, and potential ransomware or extortion operations.