MalwareUsed by 1 actorExploits 1 CVE

VersaMem

VersaMem is a web shell and in-memory Java implant associated with Volt Typhoon and observed in the Versa Director Zero Day Exploitation activity. It was installed on compromised Versa Director servers through exploitation of CVE-2024-39717 and deployed for follow-on activity. VersaMem was delivered as a Java Archive (JAR) that attaches itself to the Apache Tomcat Java servlet and web server. It relied on the Java Instrumentation API and Javassist to dynamically modify existing Java code in memory. On compromised systems, VersaMem hooked the Catalina application filter chain doFilter method to monitor inbound requests to the local Tomcat web server and inspect them for parameters including passwords and follow-on Java modules. It intercepted and harvested credentials from user logins and staged captured credentials locally at /tmp/.temp.data. The malware is also described as one of several custom web shells used by Volt Typhoon to enable persistent remote access and control.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2024-39717Arbitrary File Upload and Code Execution in Versa Director GUIExploited in the wild

VersaMem was installed through exploitation of CVE-2024-39717 in Versa Director servers.

via mitre attackattack.mitre.org

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Volt Typhoon

The group also deploys custom web shells like Awen, VersaMem, AuditReport, and iisstart.aspx, further enabling persistent remote access and control.

via cyber njcyber.nj.gov

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence2

APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.

T1059.005Visual BasicEvidence1

VersaMem was delivered as a Java Archive (JAR) that runs by attaching itself to the Apache Tomcat Java servlet and web server.

T1129Shared ModulesEvidence1

T1203Exploitation for Client ExecutionEvidence3

"...leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website." / "...has exploited client software vulnerabilities for execution..." / "...has used multiple software exploits for common client software...to gain code execution."

Persistence

2 techniques

T1505.003Web ShellEvidence1

The group also deploys custom web shells like Awen, VersaMem, AuditReport, and iisstart.aspx, further enabling persistent remote access and control.

T1543.004Launch DaemonEvidence1

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.

Privilege Escalation

1 technique

T1543.004Launch DaemonEvidence1

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence3

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

T1027.013Encrypted/Encoded FileEvidence2

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

T1070.004File DeletionEvidence5

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

Defense Impairment

1 technique

T1601Modify System ImageEvidence1

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.

Credential Access

2 techniques

T1040Network SniffingEvidence2

Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network...; APT33 has used SniffPass to collect credentials by sniffing network traffic; ArcaneDoor included network packet capture and sniffing...; multiple tools (CASTLETAP, Impacket, Empire, PoshC2, etc.) described as sniffing/packet capture.

T1056.004Credential API HookingEvidence1

Discovery

1 technique

T1040Network SniffingEvidence2

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence1

"UNC3886 has exploited CVE-2023-34048 to enable command execution on vCenter servers..." / "VersaMem was installed through exploitation of CVE-2024-39717 in Versa Director servers." / "SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148)."

Collection

3 techniques

T1056.004Credential API HookingEvidence1

T1074Data StagedEvidence1

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

T1074.001Local Data StagingEvidence1

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

mitre attack websiteNews

Mar 8, 2018

Network Sniffing, Technique T1040 - Enterprise | MITRE ATT&CK®

Tool that hooks Tomcat’s filter chain to monitor inbound web requests and inspect for credentials (e.g., passwords) and follow-on modules.

mitre attack websiteNews

Oct 1, 2016

Command and Scripting Interpreter, Technique T1059 - Enterprise | MITRE ATT&CK®

Java-based malware delivered as a JAR that attaches itself to Apache Tomcat for execution.

mitre attack websiteNews

Oct 1, 2016

Command and Scripting Interpreter, Technique T1059 - Enterprise | MITRE ATT&CK®

Java-based malware delivered as a JAR that attaches itself to Apache Tomcat.

mitre attack websiteNews

May 20, 2015

Data Staged: Local Data Staging, Sub-technique T1074.001 - Enterprise | MITRE ATT&CK®

Credential-stealing malware that stages captured credentials in a temporary local file.

+12 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

VersaMem