Campaign DetailSource-backed corpus

Versa Director Zero Day Exploitation

MITRE ATT&CK campaign C0039 attributes exploitation of Versa Director servers to Volt Typhoon from early June through August 2024. The campaign exploited CVE-2024-39717 at MSP and ISP management-plane servers, captured credentials, and deployed the VersaMem web shell for follow-on access. Because Versa Director can orchestrate SD-WAN environments, provider compromise creates a potential downstream client-access and service-continuity trust path.

Last updated Jul 10, 2026, 8:00 PM EDT

Actor Mapping

Mapped Threat Actors

Volt Typhoon

Targeting

Target Sectors / Countries

Managed Service ProvidersInternet Service ProvidersSD-WAN providersCritical InfrastructureProvider-managed client environments

Tradecraft

ATT&CK / Techniques

T1190T1573.002T1584.008T1056T1071.001T1587.001T1095T1505.003

Tools / Observables

Malware, Tools, CVEs

CVE-2024-39717

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

MITRE and Lumen support the campaign narrative, while NVD, CISA KEV, and Versa guidance control CVE/mitigation detail. Do not infer that every Versa Director or provider customer was compromised from KEV inclusion or campaign reporting.

IntelliOS

Related Intel Products

Flash Threat Intel BriefVersa Director Zero Day ExploitationPANDA brief for C0039, CVE-2024-39717, CISA KEV context, VersaMem, and MSP/ISP scoping.CARDS ActorVolt Typhoon Actor CardRelated Volt Typhoon actor record and broader source-backed targeting context.

Citations

Source Trust / Citations

[1] Versa Director Zero Day Exploitation - MITRE ATT&CKMITRE ATT&CK
[2] Taking The Crossroads: The Versa Director Zero-Day ExploitationLumen Black Lotus Labs
[3] CVE-2024-39717NIST NVD
[4] CVE-2024-39717 KEV catalog entryCISA