A hacker group connected to data theft, extortion, and ransomware is targeting SonicWall SMA 100 series appliances with a custom rootkit that opens reverse shells and steals passwords.