o-unc-038

Executive Summary

o-unc-038 is an advanced state‑backed threat actor whose operations combine sophisticated phishing campaigns with zero‑day exploitation of cloud and SD‑WAN infrastructure. They have targeted a broad spectrum of global enterprises using legitimate SaaS services for delivery, credential harvesting via AITM techniques, and a recent CVE-2024-39717 exploit in Versa Director to plant persistent web shells. The actor’s goal is to conduct widespread espionage across critical sectors while leveraging trusted relationships with managed service providers.

Goals & Targeting

o-unc-038 seeks to acquire actionable intelligence by infiltrating high‑value targets across numerous critical sectors worldwide. They exploit the trust placed in managed service providers, cloud services, and legitimate SaaS platforms to gain footholds early in the attack lifecycle. Their targeting profile spans both geographically diverse countries (from China, United States, Russia, Ukraine to many others) and mission‑critical industries such as defense, energy, government, telecommunications and pharmaceuticals, reflecting a classic state‑supported information‑warfare agenda directed at global influence and geopolitical advantage.

Key Capabilities

• Multi‑stage phishing with legitimate SaaS delivery
• Artificial ID theft via browser-in-the-box AITM
• Zero‑day exploitation of CVE-2024-39717 in Versa Director SD-WAN
• Persistent web shell deployment (VersaMem)
• Credential harvesting from email MFA tokens
• Command-and-control over Render/Telegram
• Trusted‑relationship compromise with MSPs and ISPs
• Exploitation of cloud compute infrastructure
• Malleable malware portfolio including PlugX, Pikabot, Machete

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The actor consistently employs a two‑phase strategy: initial compromise via phishing that leverages legitimate SaaS services for delivery and user trust, followed by exploitation of known or zero‑day vulnerabilities to attain privileged state access. Their campaigns show high operational tempo—deploying hundreds of domains in short periods—and they prioritize global enterprise sectors with strategic importance. While there is evidence of cross‑sector targeting in previous operations (e.g., PRC-Nexus and Volt Typhoon), recent activity remains focused on large managed service provider networks, a move that expands their internal foothold across multiple organizations simultaneously.

IOC Patterns

• Domain spoofing via fake HR or Calendly domains
• Embedded malicious Excel payloads such as enterprise-attack-v18.1-analytics.xlsx
• Zero‑day exploitation indicator CVE-2024-39717 in Versa Director
• VersaMem web shell signatures on servers
• C2 traffic to Render-hosted sites and Telegram channels
• Malleable AITM sign‑in page artifacts

Recommended Actions

• Immediately patch all Versa Director SD‑WAN appliances against CVE-2024-39717 and related vulnerabilities.
• Implement strict segmentation between customer networks and MSP/ISP infrastructure; isolate critical assets from externally managed segments.
• Deploy endpoint detection and response (EDR) capable of detecting AITM activity, such as duplicate sign‑in pages or suspicious credential requests.
• Configure MFA with additional verification methods that are not reliant on SMS/email alone; enforce enforcement across all cloud identities.
• Continuously monitor DNS and network traffic for anomalous outbound connections to Render or Telegram bots and quarantine them.
• Conduct regular threat hunting for the VersaMem web shell signature, phishing domain suffixes used by o-unc-038, and CVE‑specific exploitation patterns.
• Apply multi‑layered defenses against SSO hijacking; flag repeated authentication failures that may indicate brute‑force attempts with T1110.
• Educate users on recognizing fake HR or recruiter emails and provide clear reporting channels for suspicious messages.

Suggested Tags