CVE-2025-40599

SonicWall has released new firmware for its Secure Mobile Access (SMA) 100 series appliances, adding file-checking capabilities that help users remove known rootkit malware. The malware in question is the OVERSTEP user-mode rootkit, deployed by threat group UNC6148. The campaign In July 2025, Mandiant incident responders and Google Threat Intelligence Group (GTIG) threat analysts warned about a SonicWall SMA exploitation campaign perpetrated by UNC6148. Attackers leveraged previously stolen local administrator credentials to establish an SSL … More →

Attackers wielding the Akira ransomware and possibly a zero-day exploit have been spotted targeting SonicWall firewalls since July 15, 2025. “In the intrusions reviewed, multiple pre-ransomware intrusions were observed within a short period of time, each involving VPN access through SonicWall SSL VPNs,” Arctic Wolf researchers have warned. Though they haven’t yet ruled out the possibility of the attackers achieving initial access to the devices through brute force, dictionary attacks and credential stuffing, there is … More →

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Microsoft pins on-prem SharePoint attacks on Chinese threat actors As Microsoft continues to update its customer guidance for protecting on-prem SharePoint servers against the latest in-the-wild attacks, more security firms have begun sharing details about the ones they have detected. How to land your first job in cybersecurity According to LinkedIn, job applications have surged over 45% in the past … More →

SonicWall addressed a critical vulnerability, tracked as CVE-2025-40599 (CVSS score of 9.1), in SMA 100 appliances SonicWall addressed a critical vulnerability, tracked as CVE-2025-40599 (CVSS score of 9.1), in SMA 100 appliances. Experts warn customers to check their installs for Indicators of Compromise (IoCs) associated with Overstep malware attacks. The issue is an authenticated arbitrary […]

SonicWall advises organizations to patch SMA 100 appliances and look for IoCs associated with Overstep malware attacks.

Sonicwall is asking customers running specific Secure Mobile Access (SMA) 100 Series devices to patch a newly uncovered vulnerability (CVE-2025-40599) as soon as possible. “While there is currently no evidence that this vulnerability is being actively exploited in the wild,” Sonicwall is advising organizations using SMA 210, 410 or 500v appliances to check whether they have been compromised in a recently disclosed ongoing campaign delivering the OVERSTEP backdoor to end-of-life SMA devices. The attack campaign, … More →