China-linked Hackers Targeting Unpatched SonicWall SMA Devices with Malware

Mar 10, 2023Ravie LakshmananNetwork Security / Cyber Threat

A suspecting China-linked hacking campaign has been observed
targeting unpatched SonicWall Secure Mobile Access (SMA) 100
appliances^[1] to drop malware and
establish long-term persistence.

“The malware has functionality to steal user credentials,
provide shell access, and persist through firmware upgrades,”
cybersecurity company Mandiant said^[2]
in a technical report published this week.

The Google-owned incident response and threat intelligence firm
is tracking the activity under its uncategorized moniker
UNC4540.

The malware – a collection of bash scripts and a single ELF
binary identified as a TinyShell backdoor – is engineered to grant
the attacker privileged access to SonicWall devices.

The overall objective behind the custom toolset appears to be
credential theft, with the malware permitting the adversary to
siphon cryptographically hashed credentials from all logged-in
users. It further provides shell access to the compromised
device.

Mandiant also called out the attacker’s in-depth understanding
of the device software as well as their ability to develop tailored
malware that can achieve persistence across firmware updates and
maintain a foothold on the network.

The exact initial intrusion vector used in the attack is
unknown, and it’s suspected that the malware was likely deployed on
the devices, in some instances as early as 2021, by taking
advantage of known security flaws.

Coinciding with the disclosure, SonicWall has released updates^[3]
(version 10.2.1.7) that come with new security enhancements such as
File Integrity Monitoring (FIM) and anomalous process
identification.

The development comes nearly two months after another
China-nexus threat actor was found exploiting^[5]
a now-patched vulnerability in Fortinet FortiOS SSL-VPN as a
zero-day in attacks targeting a European government entity and a
managed service provider (MSP) located in Africa.

“In recent years Chinese attackers have deployed multiple
zero-day exploits and malware for a variety of internet facing
network appliances as a route to full enterprise intrusion,”
Mandiant said.