Overstep Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
3
occurrences
First Seen
November 20, 2025
Last Seen
June 23, 2026

Overstep is a malware family described in recent reports as being involved in campaigns targeting enterprise network security devices.

Overview

Overstep is a malware family described in recent reports as being involved in campaigns targeting enterprise network security devices. The activity is tied to exploits against SonicWall appliances, specifically involving a new SMA1000 zero-day and a SonicWall SonicOS vulnerability, underscoring the risk to firewall infrastructure and the need for timely remediation. This threat highlights how attackers leverage appliance flaws to gain access, disrupt operations, or move within networks.

Related Threat Clusters

  • Ransomware Group Targets SonicWall Gen 7 Firewalls via CVE-2024-40766

    In June 2026, a surge in attacks targeting SonicWall Gen 7 firewalls has been reported, exploiting CVE-2024-40766, an improper access control flaw. This vulnerability allows threat actors to gain unauthorized access,…

    2 articles · Updated June 23, 2026
  • SonicWall SonicOS Vulnerability Allows Remote DoS Attacks

    SonicWall has issued a security advisory regarding a critical vulnerability in its SonicOS operating system, identified as CVE-2025-40601. This high-severity flaw affects Gen7 and Gen8 hardware and virtual appliances,…

    9 articles · Updated November 20, 2025
  • SonicWall SMA1000 Zero-Day Vulnerability Disclosed

    SonicWall has alerted customers to a local privilege escalation vulnerability (CVE-2025-40602) in the SMA1000 Appliance Management Console, which has been exploited in the wild in conjunction with another vulnerability…

    5 articles · Updated December 17, 2025
  • SonicWall SonicOS Flaw Allows Remote Firewall Crashes

    SonicWall has disclosed a critical vulnerability in its SonicOS SSLVPN service, tracked as CVE-2025-40601, which allows remote, unauthenticated attackers to crash Gen7 and Gen8 firewalls. The flaw, caused by a…

    11 articles · Updated November 24, 2025

Recent Intelligence Reports

  • Bitdefender — www.bitdefender.com · June 23, 2026
  • Sonicwall warns of new SMA1000 zero — Bleepingcomputer · December 17, 2025
  • New SonicWall SonicOS flaw allows hackers to crash firewalls — Bleepingcomputer · November 20, 2025

CVSS v3.1 Breakdown