Suspected Chinese State Hackers Breach Telecom SD-WAN Management Systems via Versa Zero-Day

Correction (2026-10-15): An earlier version of this article named Volt Typhoon, and described the intrusions as the work of Chinese state hackers, without qualification. Black Lotus Labs attributed the VersaMem activity to Volt Typhoon and Bronze Silhouette with only moderate confidence (source: Black Lotus Labs, 27 Aug 2024), and the headline, wording and table now say so. The earlier lede also said "global telecommunications providers"; Black Lotus Labs counted four U.S. victims and one non-U.S. victim in the ISP, MSP and IT sectors. The intrusions described here took place in 2024 (earliest observed June 12, 2024); this article was published in 2026.

Black Lotus Labs assessed, with moderate confidence, that Chinese state-sponsored operators known as Volt Typhoon compromised four U.S. victims and one non-U.S. victim in the internet service provider (ISP), managed service provider (MSP) and information technology (IT) sectors by exploiting a zero-day flaw in Versa Networks' SD-WAN management software. The campaign deployed a memory-only Java webshell dubbed VersaMem directly into the orchestrator runtime, allowing attackers to harvest plaintext administrative credentials and gain deep visibility into downstream customer networks without leaving standard disk artifacts.

Federal cybersecurity authorities added the underlying vulnerability, cataloged as CVE-2024-39717, to the Known Exploited Vulnerabilities Catalog after forensic investigators identified active exploitation in the wild. While initial industry alerts mischaracterized the vulnerability as an unauthenticated attack, confirmed technical disclosures establish that exploitation requires high-tier administrative credentials. Attackers leveraged compromised credentials to reach exposed management interfaces and weaponized an unrestricted file upload flaw within the appliance's user interface.

Vulnerability Root Cause and Exploitation Flow

The vulnerability resides within the Versa Network Management System (VNMS) graphical interface, specifically inside the administrative "Change Favicon" customization module. The endpoint failed to execute server-side MIME type or magic-byte verification on incoming files, relying solely on client-side filename extensions.

An attacker possessing Provider-Data-Center-Admin privileges could transmit a malicious Java Archive (.jar) file appended with an image extension such as .png. The application backend accepted the payload and wrote the binary directly into the web-accessible directory structure:

/var/versa/vnms/web/custom_logo/

Once written to storage, the embedded Apache Tomcat servlet container dynamically resolved and executed the Java bytecode, initiating the in-memory execution pipeline.

VersaMem Memory Forensics and Interception Mechanics

VersaMem operates strictly in volatile JVM memory to bypass disk-based File Integrity Monitoring (FIM). Instead of registering new servlets in configuration files like web.xml, the malware manipulates active Java bytecode directly inside the Java Virtual Machine (JVM).

Using the Javassist bytecode manipulation library, VersaMem intercepts the request processing pipeline by hooking ApplicationFilterChain.doFilter() within Tomcat's Catalina engine.

This hooking mechanism enables two critical capabilities:

• Credential Harvesting: VersaMem evaluates incoming HttpServletRequest objects targeting authentication paths, notably /vnms/login. It extracts raw username and password parameters before the application encrypts or hashes them, storing the credentials in an internal memory buffer.
• Reflective Bytecode Execution: The webshell listens for distinct HTTP headers containing base64-encoded Java class definitions. Using ClassLoader.defineClass(), it dynamically instantiates and executes secondary payloads entirely within JVM heap space, avoiding secondary file creation on the underlying Linux filesystem.

Forensic Detection Playbook and SRE Inspection Commands

Incident response teams managing Versa appliances must conduct multi-layer inspections across the local filesystem, active Java runtime memory, and authentication logs:

# 1. Inspect Custom Logo Directory for Non-Image Binaries
file -b --mime-type /var/versa/vnms/web/custom_logo/*

# Alert on output containing: application/zip, application/java-archive, or text/plain
# Expected baseline: image/png or image/jpeg

# 2. Extract Classloader Statistics and Detect Dynamic Bytecode Engines
TOMCAT_PID=$(pgrep -f "org.apache.catalina.startup.Bootstrap" || pgrep -f "vnms")
jcmd ${TOMCAT_PID} VM.classloader_stats
jcmd ${TOMCAT_PID} GC.class_histogram | grep -E "javassist|VersaMem|custom_logo"

# 3. Capture Thread Dumps and Live Memory Heap for Analysis
jstack -l ${TOMCAT_PID} > /tmp/tomcat_thread_dump.log
jmap -dump:live,format=b,file=/tmp/tomcat_heap_dump.hprof ${TOMCAT_PID}

# 4. Search Access Logs for Weaponized Favicon Calls
grep -En "POST.*/(changeFavicon|custom_logo)" /var/versa/vnms/logs/localhost_access_log*

# 5. Audit Provider-Level Administrative Logins
grep -i "login" /var/versa/vnms/logs/vnms-audit.log | grep -E "Provider-Data-Center-Admin|Provider-Data-Center-System-Admin"

Step-by-Step Port Isolation and Firewall Lockdown

Exploitation was facilitated by architectural misconfigurations in multi-tenant environments where management nodes were exposed to untrusted WANs rather than isolated Out-of-Band Management (OOBM) networks.

• Exposed High Availability Ports: Unfiltered access to TCP 4566 (Cisco NCS / Tail-f sync) and TCP 4570 (active-standby cluster messaging) exposed low-level coordination protocols directly to WAN interfaces.
• Exposed Management Interfaces: Web interfaces on ports 9182, 9183, and 443 permitted direct ingress connections from untrusted endpoints.

Enforce host-level packet filtering across all Director nodes to restrict these channels:

# Flush Existing VNMSHA Chain Rules
iptables -F VNMSHA 2>/dev/null || iptables -N VNMSHA

# Restrict HA Ports Exclusively to Explicit Peer Director Node IP
iptables -A INPUT -p tcp -s <PEER_DIRECTOR_IP> -m multiport --dports 4566,4570 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 4566,4570 -j DROP

# Restrict PostgreSQL Replication to Peer Director Node
iptables -A INPUT -p tcp -s <PEER_DIRECTOR_IP> --dport 5432 -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j DROP

# Restrict Web Management Access to Authorized Bastion CIDR
iptables -A INPUT -p tcp -s <TRUSTED_MGMT_SUBNET_CIDR> -m multiport --dports 9182,9183,443 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 9182,9183,443 -j DROP

# Persist Firewall Rules Across System Restarts
iptables-save > /etc/iptables/rules.v4

Affected Versions, Patch Validation, and Tenant Blast Radius

Organizations must verify installed software baselines and execute mandatory runtime restarts to clear active in-memory hooks: A similar in-memory foothold let a PaperCut zero-day swarm reach rapid Active Directory compromise elsewhere.

# Verify Operating Version
versa-version

# Mandatory Daemon and JVM Restart to Terminate Memory Hooks
systemctl restart versa-director

# Confirm New Process Lifetime and PID
ps -eo pid,lstart,cmd | grep -i catalina

Downstream Blast Radius: A compromise at the Provider-Data-Center-Admin level collapses tenant isolation. Attackers gain access to IPsec Pre-Shared Keys (PSKs), cryptographic private keys, routing tables, and Zero-Touch Provisioning (ZTP) templates. Service providers must force tenant-wide credential rotations, re-key all SD-WAN IPsec mesh overlays, and audit live branch device configurations against baseline backups.

Long-Term SD-WAN Management Plane Hardening

Securing edge orchestration fabrics requires strict decoupling of control, management, and synchronization planes under Zero Trust Network Architecture (ZTNA) principles:

• Eliminate Public Management Exposure: Director nodes must reside strictly inside isolated management Virtual Routing and Forwarding (VRF) instances, accessible solely via bastion hosts enforcing FIDO2 hardware authentication.
• Microsegment Cluster Interconnects: Inter-node synchronization across TCP 4566, 4570, and 5432 must be restricted to isolated, point-to-point /30 subnets.
• Runtime Integrity Enforcement: Deploy Linux extended Berkeley Packet Filters (eBPF) to monitor JVM file descriptors and enforce read-only mount permissions across web server root directories.

Related reading

• SolarWinds Web Help Desk Flaws: Technical Analysis, Triage, and Defense
• Critical Flaws in Palo Alto Networks Expedition Expose Enterprise Firewalls to Takeover
• Critical Apache OFBiz Flaws Expose Enterprise ERPs to Unauthenticated Remote Code Execution