Chinese state-backed hacking group, Volt Typhoon, has been accused as the culprit behind a series of cyberattacks exploiting a zero-day vulnerability in the Versa Director network management platform, tracked as CVE-2024-39717. The flaw was patched in Versa Director version 22.1.4 but affects all prior versions. Volt Typhoon has a history of targeting critical infrastructure in the U.S. and other nations. In this campaign, the group used the vulnerability to upload a custom web shell named VersaMem, designed to intercept and harvest credentials from compromised servers. This web shell, which avoided detection by antivirus software, allowed the attackers to execute arbitrary malicious code and maintain a persistent presence on the targeted networks. The attacks primarily targeted four (4) U.S. victims and one (1) non-U.S. victim in the Internet service provider (ISP), managed service provider (MSP), and information technology (IT) sectors. The earliest known exploitation of the vulnerability was detected in June 2024, observed in Singapore. Volt Typhoon’s use of small office/home office (SOHO) devices to route network traffic and evade detection aligns with their known tactics, techniques, and procedures (TTPs). The group’s sophisticated methods include leveraging Java instrumentation to inject malicious code into the Tomcat web server process on compromised Versa Director servers, enabling them to execute further attacks using already harvested credentials. The U.S. government and cybersecurity agencies have been vigilant in addressing the threats posed by Volt Typhoon, considering the group’s potential to disrupt critical infrastructure and military mobilization efforts. The White House, Defense Department, and other agencies have raised alarms about the group’s preemptive efforts to gain strategic footholds in U.S. infrastructure. Mitigation measures recommended by CTIX analysts include applying the necessary patches, blocking external access to specific ports (4566 & 4570), and monitoring for suspicious network traffic, especially traffic originating from SOHO routers. Organizations are advised to segment vulnerable devices within protected networks to prevent exposure to public internet threats.