Chinese hackers target unpatched SonicWall SMA Edge Devices

According to a recent Mandiant research document, since 2021, a malware campaign has been targeting unpatched SonicWall SMA edge devices, persisting even after firmware updates. The malware campaign is thought to be a Chinese cyber espionage campaign aimed at stealing user credentials for cyber espionage purposes.

The malware is made up of several bash scripts and one ELF binary file, which has been identified as a TinyShell backdoor variant. The main malware process is a file called “firewalld,” which executes the TinyShell backdoor with parameters that allow it to provide the threat actor with a reverse shell. A copy of the “firewalld” file called “iptabled” was also modified to ensure the primary malware’s survival in the event of a crash or termination. A startup script called “rc.local” launches the malware at boot time to allow for extended access.

The malware’s ultimate goal is to execute a SQL command to obtain the hashed credentials of all logged-in users, which the attacker can then use to crack them offline. On an infected device, a bash script called “geoBotnetd” checks every 10 seconds for a firmware upgrade. If a firmware upgrade is discovered, the script will backup the file, unzip it, mount it, and copy over the entire malware package. It also installs a backdoored root user called “acme” on the system.

Mandiant researchers believe the attackers encountered problems while shutting down the instance with the “firebased” script and wrote a small script to fix it. While not particularly sophisticated, the technique used in this attack campaign necessitates a thorough understanding of the firmware upgrade process in order to create and deploy, indicating the attackers’ desire to maintain long-term access.

While the primary vector of infection is unknown, Mandiant researchers believe the malware, or its predecessor was likely deployed in 2021 and that the threat actor likely retained access despite multiple firmware updates. SonicWall recommends that SMA100 customers upgrade to version or higher, which includes hardening enhancements like File Integrity Monitoring (FIM) and anomalous process detection.

The sources for this piece include an article in TechRepublic.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web