Versa Director Zero Day Exploitation

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Versa Director Zero Day Exploitation was conducted by Volt Typhoon from early June through August 2024 as zero-day exploitation of Versa Director servers controlling software-defined wide area network (SD-WAN) applications. Since tracked as CVE-2024-39717, exploitation focused on credential capture from compromised Versa Director servers at managed service providers (MSPs) and internet service providers (ISPs) to enable follow-on access to service provider clients. Versa Director Zero Day Exploitation was followed by the delivery of the VersaMem web shell for both credential theft and follow-on code execution.(Citation: Lumen Versa 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

Volt Typhoon

Attribution confidence

Not established

First documented activity

2024-06-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2024-06-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2024-08-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1190 · Exploit Public-Facing Application

  Initial Access — Versa Director Zero Day Exploitation involved exploitation of a vulnerability in Versa Director servers, since identified as CVE-2024-39717, for initial access and code execution.(Citation: Lumen Versa 2024)

• T1573.002 · Asymmetric Cryptography

  Command And Control — Versa Director Zero Day Exploitation used HTTPS for command and control of compromised Versa Director servers.(Citation: Lumen Versa 2024)

• T1584.008 · Network Devices

  Resource Development — Versa Director Zero Day Exploitation used compromised small office/home office (SOHO) devices to interact with vulnerable Versa Director servers.(Citation: Lumen Versa 2024)

• T1056 · Input Capture

  Collection, Credential Access — Versa Director Zero Day Exploitation intercepted and harvested credentials from user logins to compromised devices.(Citation: Lumen Versa 2024)

• T1071.001 · Web Protocols

  Command And Control — Versa Director Zero Day Exploitation established HTTPS communications from adversary-controlled SOHO devices over port 443 with compromised Versa Director servers.(Citation: Lumen Versa 2024)

• T1587.001 · Malware

  Resource Development — Versa Director Zero Day Exploitation involved the development of a new web shell variant, VersaMem.(Citation: Lumen Versa 2024)

• T1095 · Non-Application Layer Protocol

  Command And Control — Versa Director Zero Day Exploitation used a non-standard TCP session to initialize communication prior to establishing HTTPS command and control.(Citation: Lumen Versa 2024)

• T1505.003 · Web Shell

  Persistence — Versa Director Zero Day Exploitation resulted in the deployment of the VersaMem web shell for follow-on activity.(Citation: Lumen Versa 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0039

  Official MITRE ATT&CK campaign record C0039. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.