Log in Request a demo

Malware profile

VersaMem

VersaMem is a web shell that MITRE ATT&CK says was built for Versa Director servers, which help manage SD-WAN networks.

In short

VersaMem is a web shell that MITRE ATT&CK says was built for Versa Director servers, which help manage SD-WAN networks. It is a Java Archive that captures logon credentials and can run further Java payloads. MITRE lists it as used by Volt Typhoon in a zero-day campaign against ISPs and MSPs in 2024.

Last updated 9 October 2026

Profile MapMalware
  1. Names1names in public reportsVersaMem
  2. Techniques8ATT&CK techniques listedExecution · Credential Access · Collection
  3. Infection Steps4in the delivery chainExploit the flaw · Deliver the web shell
  4. Linked Groups1groups that use itVolt Typhoon

In one minute

What it is
A web shell, delivered as a Java Archive (JAR), made for Versa Director servers. MITRE says it was discovered in August 2024.
What it does
Hooks the Versa login routine to capture plaintext credentials, stores them encrypted on the server, and can run further Java payloads that it receives.
Who uses it
Attributed by MITRE ATT&CK to Volt Typhoon, in a Versa Director campaign it dates June to August 2024. CISA's two Versa alerts do not name an actor, and CISA's Volt Typhoon advisory AA24-038A does not mention VersaMem.
How it gets in
Exploitation of CVE-2024-39717, a file upload flaw in Versa Director, as MITRE describes it.
What to do first
Apply the Versa fix for CVE-2024-39717, hunt for malicious activity on Versa Director servers as CISA urges, and report positive findings to CISA.

What it does

Versa Director is a product used to manage SD-WAN networks, and CISA says some Internet Service Providers and Managed Service Providers use it. MITRE says VersaMem was placed on these servers after the attackers had broken in, so that they could keep stealing logon details and run more code.

MITRE describes it as running inside the web server rather than as a separate program. It hooks the login routine and the web request path, so it sees passwords as people submit them.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
VersaMemMITRE ATT&CK software S1154 (no other names listed)[1, 2]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Execution

  • Command and Scripting Interpreter T1059

    It ships as a Java Archive that runs by attaching itself to the Apache Tomcat servlet and web server.[1]

  • Exploitation for Client Execution T1203

    It was installed by exploiting CVE-2024-39717 in Versa Director servers.[1]

  • Shared Modules T1129

    It uses the Java Instrumentation API and Javassist to change Java code that is already in memory.[1]

Credential Access

  • Input Capture: Credential API Hooking T1056.004

    It hooks and overrides Versa's own authentication method, setUserPassword, to catch plaintext credentials as they are submitted.[1]

  • Network Sniffing T1040

    It hooks the Tomcat filter chain to watch all inbound requests to the local web server for passwords and for follow-on Java modules.[1]

Collection

  • Data Staged: Local Data Staging T1074.001

    It keeps captured credentials in a local file at /tmp/.temp.data.[1]

Stealth

  • Obfuscated Files or Information: Encrypted/Encoded File T1027.013

    It encrypts captured credentials with AES and then Base64 encodes them before writing them to local storage.[1]

  • Indicator Removal: File Deletion T1070.004

    It deletes files left from the first install, such as temporary files tied to the process ID of the main web process.[1]

How it spreads

MITRE says VersaMem was installed after attackers exploited CVE-2024-39717 in Versa Director servers. CISA lists this flaw in its Known Exploited Vulnerabilities Catalog (added 23 August 2024) as an unrestricted file upload flaw in the Versa Director GUI. MITRE describes the campaign as aimed at Versa Director servers at managed service providers and internet service providers, to enable follow-on access to the providers' clients. No government source found describes any other way it spreads.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Exploit the flaw

    Attackers exploit a vulnerability in Versa Director servers, since identified as CVE-2024-39717, for initial access and code execution.[2]

  2. Deliver the web shell

    The exploitation is followed by delivery of the VersaMem web shell, for credential theft and follow-on code execution.[2]

  3. Capture credentials

    VersaMem hooks the login routine, then encrypts and stages captured credentials locally.[1]

  4. Reach the clients

    MITRE says the credentials let attackers gain follow-on access to the clients of the service provider.[2]

Timeline

  1. 7 February 2024

    CISA, NSA and FBI advisory on Volt Typhoon

    AA24-038A says the agencies assess that PRC state-sponsored actors are pre-positioning on IT networks of US critical infrastructure. It does not mention VersaMem or Versa Director.[8]

  2. June 2024

    Versa Director exploitation begins

    MITRE dates the campaign it attributes to Volt Typhoon from early June 2024.[2]

  3. 22 August 2024

    CVE-2024-39717 published

    The National Vulnerability Database record for the Versa Director flaw is first published.[7]

  4. August 2024

    VersaMem discovered

    MITRE says VersaMem was discovered in August 2024 and that the campaign ran through August 2024.[1, 2]

  5. August 23, 2024

    Added to CISA catalog

    CISA adds CVE-2024-39717 to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.[4]

  6. August 27, 2024

    CISA alert on Versa Director

    CISA urges organizations to apply updates, hunt for malicious activity and report positive findings to CISA.[5]

Detection and defense

  1. Patch Versa Director and hunt

    CISA urges organizations to apply necessary updates, hunt for any malicious activity and report any positive findings to CISA. The catalog entry says to apply the vendor's mitigations or stop using the product if none exist.[4, 5, 6]

    Counters: T1203

  2. Patch internet-facing appliances

    AA24-038A tells organizations to apply patches on internet-facing systems and to prioritize known exploited vulnerabilities.[8]

    Counters: T1203

  3. Keep management interfaces off the Internet

    AA24-038A advises reducing the attack surface by not exposing systems or management interfaces to the Internet when not necessary.[8]

    Counters: T1203 T1059

  4. Log centrally

    AA24-038A says to turn on application, access and security logs and store them in a central system.[8]

    Counters: T1070.004 T1074.001

  5. Use phishing-resistant MFA

    AA24-038A recommends phishing-resistant MFA for access to assets.[8]

    Counters: T1056.004 T1040

  6. Follow the edge device guidance

    CISA lists joint guidance from CCCS, NCSC-UK and ACSC on protecting network edge devices, published 4 February 2025.[10]

    Counters: T1203

  7. Use the official web shell guidance

    The NSA and ASD information sheet on web shell malware gives techniques to detect and recommendations to prevent web shells, as announced in a CISA alert. No government detection signatures for VersaMem itself were found.[9]

    Counters: T1059 T1129

Questions

What is VersaMem?

MITRE ATT&CK calls it a web shell designed for deployment to Versa Director servers following exploitation, delivered as a Java Archive. It captures logon credentials and can run further Java payloads.

Which flaw was used to install it?

MITRE says VersaMem was installed through exploitation of CVE-2024-39717 in Versa Director servers. CISA added that flaw to its Known Exploited Vulnerabilities Catalog on 23 August 2024.

Who is linked to VersaMem?

MITRE ATT&CK lists Volt Typhoon as the user, in a campaign it dates June to August 2024. CISA's alerts on the Versa flaw do not name an actor.

Who was targeted?

MITRE says the campaign focused on Versa Director servers at managed service providers and internet service providers, to enable follow-on access to their clients.

What should defenders do?

CISA urges organizations to apply updates for the Versa flaw, hunt for malicious activity and report positive findings to CISA.

In our research

  1. Living off the Land: The Cyberattack You’ll Never See Coming June 2025
  2. Volt Typhoon Threat group

Sources

  1. VersaMem, Software S1154 MITRE ATT&CKSupports: Description, techniques, discovery in August 2024, CVE-2024-39717, Volt Typhoon link.
  2. Versa Director Zero Day Exploitation, Campaign C0039 MITRE ATT&CKSupports: Campaign dates, targets, order of events.
  3. Volt Typhoon, Group G1017 MITRE ATT&CKSupports: MITRE lists the campaign under Volt Typhoon.
  4. CISA Adds One Known Exploited Vulnerability to Catalog for Versa Networks Director CISASupports: Catalog addition on 23 August 2024.
  5. Versa Networks Releases Advisory for a Vulnerability in Versa Director, CVE-2024-39717 CISASupports: Product use, risk, CISA actions urged.
  6. Known Exploited Vulnerabilities Catalog (JSON feed) CISASupports: Catalog entry for CVE-2024-39717 and required action.
  7. CVE-2024-39717 record NIST National Vulnerability DatabaseSupports: Flaw description and publication date.
  8. PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, AA24-038A CISA, NSA, FBISupports: Agency assessment of Volt Typhoon and mitigations.
  9. NSA, ASD Release Guidance for Mitigating Web Shell Malware CISASupports: Official web shell detection and prevention guidance.
  10. Guidance and Strategies to Protect Network Edge Devices CISASupports: Joint edge device guidance, 4 February 2025.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Zero-day vulnerability

A zero-day vulnerability is a weakness in hardware, firmware or software that was previously unknown.

Read more