Malware targeting SonicWall devices could survive firmware updates

Researchers at Mandiant have identified a malware campaign targeting SonicWall SMA 100 Series appliances, thought to be of Chinese origin. The malware was likely deployed in 2021, and was able to persist on the appliances tenaciously, even surviving firmware upgrades. The malware was able to steal user credentials and provide shell access.

The SMA 100 Series is an access control system that lets remote users log in to company resources. It offers a combined single-sign-on (SSO) web portal to authenticate …

access access control campaign chinese control control system credentials devices firmware firmware updates log malware malware campaign mandiant origin researchers resources series shell sma sma 100 sonicwall sonicwall sma steal system targeting thought updates