MITRE ATT&CKcampaign
C0039 Versa Director Zero Day Exploitation
- Domain
- enterprise
- Version
- 1.0
- Created
- 2024-08-27
Description
Versa Director Zero Day Exploitation was conducted by Volt Typhoon from early June through August 2024 as zero-day exploitation of Versa Director servers controlling software-defined wide area network (SD-WAN) applications. Since tracked as CVE-2024-39717, exploitation focused on credential capture from compromised Versa Director servers at managed service providers (MSPs) and internet service providers (ISPs) to enable follow-on access to service provider clients. Versa Director Zero Day Exploitation was followed by the delivery of the VersaMem web shell for both credential theft and follow-on code execution.
Related
Attributed to · MITRE ATT&CK (1)
- G1017 Volt Typhoon group
Uses · MITRE ATT&CK (9)
- S1154 VersaMem software (malware)
- T1584.008 Network Devices sub-technique
- T1587.001 Malware sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1505.003 Web Shell sub-technique
- T1190 Exploit Public-Facing Application technique
- T1056 Input Capture technique
- T1095 Non-Application Layer Protocol technique