S1154 VersaMem

malwareEnterprise

platformsNetwork Devices

also known asVersaMem

VersaMem is a web shell designed for deployment to Versa Director servers following exploitation. Discovered in August 2024, VersaMem was used during Versa Director Zero Day Exploitation by Volt Typhoon to target ISPs and MSPs. VersaMem is deployed as a Java Archive (JAR) and allows for credential capture for Versa Director logon activity as well as follow-on execution of arbitrary Java payloads.

techniques used (8)

ATT&CK techniques this enables or maps to.

T1027.013Encrypted/Encoded File
T1040Network Sniffing
T1056.004Credential API Hooking
T1059Command and Scripting Interpreter
T1070.004File Deletion
T1074.001Local Data Staging
T1129Shared Modules
T1203Exploitation for Client Execution

used by groups (1)

Threat groups associated with this.

G1017Volt Typhoon

used by campaigns (1)

Campaigns that use this.

C0039Versa Director Zero Day Exploitation

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan