MITRE ATT&CKsoftware (malware)

S1154 VersaMem

Published 2024-08-27 Modified 2025-04-15 Official page ↗
Domain
enterprise
Platforms
Network Devices
Version
1.1
Created
2024-08-27

Description

VersaMem is a web shell designed for deployment to Versa Director servers following exploitation. Discovered in August 2024, VersaMem was used during Versa Director Zero Day Exploitation by Volt Typhoon to target ISPs and MSPs. VersaMem is deployed as a Java Archive (JAR) and allows for credential capture for Versa Director logon activity as well as follow-on execution of arbitrary Java payloads.

Related

Uses · MITRE ATT&CK (8)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1056.004 Credential API Hooking sub-technique
  • T1070.004 File Deletion sub-technique
  • T1203 Exploitation for Client Execution technique
  • T1040 Network Sniffing technique
  • T1059 Command and Scripting Interpreter technique
  • T1129 Shared Modules technique

Referenced by MITRE ATT&CK · uses (2)

  • C0039 Versa Director Zero Day Exploitation campaign
  • G1017 Volt Typhoon group

References