Your security team must always be up-to-date and aware of the threats targeting organizations in your industry. As you begin your journey as a Threat Intelligence Intern, equipped with some SOC experience, your manager has assigned you a task to test your research skills and how effectively you can leverage the MITRE ATT&CK framework.
Impress your manager with your assessment, showcasing your passion for threat intelligence.
Volt Typhoon is a state-sponsored actor that MITRE tracks as G1017. Its credential access leans on dumping the Active Directory database from a domain controller, which only works with the matching registry hive in hand. In the June 2024 campaign the group exploited a Versa Director zero-day and dropped a Java web shell that harvests credentials and stages them in a hidden file on disk. The earliest sample of that shell, a disguised image upload, can be traced through the Lumen research post to VirusTotal, where it turns out to be a JAR built with Maven. CISA’s joint advisory shows the group’s main defense evasion is living off the land, with built-in PowerShell used to review logon events and write them to a file.
This case ships no evidence files. Everything comes from public sources:
curlpdftotextSource note: Several questions point at “MITRE’s reference”. Follow the reference link on the MITRE page to the original vendor or government document instead of answering from the MITRE summary alone.
The G1017 group page opens with the actor’s first-seen year in the description. The answer comes straight from that sentence.
On the G1017 page the June 2024 campaign lists the Versa Director zero-day exploitation, and the software entry attached to it is S1154. The MITRE software page names the malware.
curl -s https://attack.mitre.org/software/S1154/The S1154 software page and the Lumen post both tie VersaMem to the same Versa Director vulnerability. The CVE is in the MITRE description and in the Lumen write-up.
On the G1017 technique table, filter to OS Credential Dumping. Two sub-techniques are listed: LSASS Memory and a second one that targets the domain controller’s database.
curl -s https://attack.mitre.org/groups/G1017/From Q2 the technique is T1003.003. Its page names the target as the Active Directory domain database, stored as NTDS.dit on domain controllers.
curl -s https://attack.mitre.org/techniques/T1003/003/The T1003.003 page lists the ntdsutil and secretsdump style examples, where the NTDS.dit extraction is paired with a registry hive saved alongside it. That hive holds the key material needed to decrypt the database offline. The page doesn’t state it as a one-line fact, so this answer was reasoned from the examples and the ****** format mask.
The G1017 technique table lists Server Software Component: Web Shell (T1505.003) for the Versa Director activity. The sub-technique name is the malware type.
Back on the S1154 page, the Local Data Staging entry describes where VersaMem writes the credentials it captures. It is a hidden file under /tmp.
curl -s https://attack.mitre.org/software/S1154/Follow the Lumen reference from the S1154 page to the Black Lotus Labs post. The figure caption that shows the VirusTotal upload names the first sample by its submitted filename. The old blog.lumen.com link redirects to the Lumen home page, so search for the post title to land on the current lumen.com/blog URL.
Tip: The filename looks like an image upload, which is deliberate disguise for a Java archive.
The same Lumen caption carries the SHA256 of the sample. Looking the hash up in VirusTotal confirms it resolves to the VersaTest.png submission from Q8.
vt 4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37 --jsonIn the VirusTotal JSON for the Q9 hash, type_description gives the detected file type. It is not an image, despite the .png name.
vt 4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37 --json | grep type_descriptionA JAR carries a META-INF/MANIFEST.MF, and VirusTotal parses it under jar_info.manifest. The Created-By entry there names the build tool and version.
vt 4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37 --json | grep -A20 jar_infoConvert the advisory PDF to text and search for defense evasion. The advisory states the actors primarily use living off the land for evasion, which is native tools instead of custom malware. The answer is the four-letter abbreviation the document itself uses.
pdftotext aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf - | grep -i -n "LOTL"In the same text dump, search for the event log query. The advisory shows a PowerShell Get-EventLog call that filters Security event 4624 (successful logons) and pipes the result to Out-File. The output path is the file name the question wants.
pdftotext aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf - | grep -n "Get-EventLog"Gotcha: The path is lowercase in the advisory and uses backslashes. Copy it as printed.
| Phase | Action |
|---|---|
| Initial Access | Zero-day exploitation of Versa Director in the June 2024 campaign |
| Persistence | VersaMem Java web shell deployed on the server |
| Collection | Captured credentials staged in a hidden file under /tmp |
| Credential Access | NTDS.dit dumped from domain controllers, with the SYSTEM hive for decryption |
| Defense Evasion | Living off the land instead of custom tooling |
| Discovery | PowerShell review of 4624 logon events written to a file |
| Type | Value |
|---|---|
| SHA256 | 4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37 |
| Filename (first VirusTotal upload) | VersaTest.png |
| File path (credential staging) | /tmp/.temp.data |
| File path (logon analysis output) | C:\users\public\documents\user.dat |
| CVE | CVE-2024-39717 |
| Technique | ID | Description |
|---|---|---|
| Exploit Public-Facing Application | T1190 | Versa Director zero-day |
| OS Credential Dumping: NTDS | T1003.003 | Active Directory database dumped for offline cracking |
| Server Software Component: Web Shell | T1505.003 | VersaMem deployed on the Versa Director server |
| Data Staged: Local Data Staging | T1074.001 | Credentials written to /tmp/.temp.data |
| Command and Scripting Interpreter: PowerShell | T1059.001 | Get-EventLog logon review |
Management appliances are high-value targets. A zero-day in Versa Director gave the actor a foothold on a system that sits close to network infrastructure. Patch for CVE-2024-39717 and keep management interfaces off the internet.
Check what a file really is, not what it is called. The first uploaded sample was named like an image but was a JAR. Content-based file typing in upload paths and on web servers catches this quickly.
Watch for credential staging files and NTDS access. A hidden file under /tmp and a domain controller’s NTDS.dit being copied are both specific, alertable behaviours. Pair the NTDS.dit alert with any registry hive save on the same host.
Living off the land needs behaviour-based detection. When the main evasion strategy is built-in tooling, the signal is the command line. A PowerShell Get-EventLog pull of 4624 events written into a public documents folder is anomalous for most hosts and cheap to detect.
Volt Typhoon turned a Versa Director zero-day into credential theft using a Java web shell dressed as an image, then relied on built-in Windows tools to stay quiet. All of it can be traced through public MITRE, vendor and CISA reporting, which makes this actor’s tradecraft well suited to behaviour-focused detection.