Chinese Volt Typhoon Hackers Strike Again in Critical Zero-Day Attack That Threatens Network Security
In a disturbing development, cybersecurity experts at Lumen Technologies have uncovered a new wave of cyberattacks by the Chinese hacking group Volt Typhoon, exploiting a serious vulnerability in Versa Director servers. This zero-day flaw, identified as CVE-2024-39717, poses a severe threat, especially to Internet Service Providers (ISPs) and Managed Service Providers (MSPs), whose networks are at risk of being infiltrated.
The vulnerability was recently added to the CISA must-patch list, signaling its critical nature. Versa Networks confirmed that the flaw allows attackers to breach the Versa Director graphical user interface (GUI) and deploy malware on compromised devices. Versa Director servers, vital for managing network configurations in SD-WAN software, are now prime targets for these sophisticated cybercriminals.
Volt Typhoon, a group with ties to the Chinese government, has been linked to the exploitation of this vulnerability. Lumen Technologies' Black Lotus Labs team discovered a unique web shell being used to hijack credentials and gain unauthorized access to networks of downstream customers. The group’s activities have been traced back to June 12, 2024, and they continue to wreak havoc on several U.S. organizations, particularly within the ISP, MSP, and IT sectors.
The ramifications of this breach are severe. Volt Typhoon's history is fraught with attacks on critical infrastructure across various sectors, including communications, utilities, transportation, and government. Their methods are sophisticated, and their campaigns are targeted, leaving numerous organizations vulnerable to devastating consequences.
Versa Networks has acknowledged a case where the vulnerability was exploited due to outdated firewall guidelines that had not been implemented by a customer. This oversight allowed the attackers to exploit the flaw without needing to access the GUI. While Versa Networks appears to shift some responsibility onto victim organizations for these configuration errors, the reality is that this vulnerability presents a significant danger to all affected networks.
The Black Lotus Labs team has sounded the alarm, warning that Volt Typhoon’s campaign is likely ongoing against unpatched Versa Director systems. With the group’s known tactics and the growing sophistication of their attacks, it is imperative that organizations take immediate action to secure their networks.
The full scope of this threat is yet to be fully understood, but the consequences could be catastrophic if left unaddressed. The Black Lotus Labs team is expected to release detailed technical documentation, including Indicators of Compromise (IOCs) and telemetry data, to assist organizations in identifying and mitigating the risks posed by this exploit.
In light of this alarming situation, all organizations using Versa Director servers are urged to patch their systems immediately and review their security configurations. The danger is real, and the stakes are high—failure to act could result in a breach that could cripple critical infrastructure and compromise sensitive data. The clock is ticking, and the time to act is now.
