Volexity

volexity.comMind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCPLast month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Go...

Volexity has published Part 3 of its Mind the (Patch) Gap series, taking a closer look at Volexity #Volcano, one of the most advanced tools behind its Chrome & Windows 0day findings, and its new MCP server for AI-assisted triage, IOC creation & endpoint collection. www.volexity.com/blog/2026/10...

The Volexity Cyber Sessions event is this Thursday in Amsterdam! Steven Adair will kick things off with "Mind the (Patch) Gap: When Fixed Vulnerabilities Are 0-Days", followed by talks from Roey Shua, Christopher Lopez & Feike Hacquebord. #dfir

luma.comVolexity Cyber Sessions – Amsterdam | October 2026 · LumaJoin Us in Amsterdam We are excited to announce our first Volexity Cyber Sessions meetup in Amsterdam! Seating is limited for this in-person event. Register…

The event is at capacity, but you can still join the waitlist: luma.com/0qtkw49c #dfir

Heading to #BSidesAugusta this Saturday, Oct 24? Catch Volexity’s Director of Research, Andrew Case (@attrc.bsky.social), at 10:00 AM (Track 1 - Plug N Play) for his talk, “Finding Evil Fast: Windows Memory Triage with Volatility 3”. #dfir #memoryforensics

We’re officially at capacity! Thank you to everyone who registered for Volexity Cyber Sessions in Amsterdam. Registration is now closed, but you can join the waitlist on the event page: luma.com/0qtkw49c See you Oct 29 for an afternoon of DFIR talks, followed by dinner, drinks & networking! #dfir

Volexity reposted

Volcano now speaks MCP. One prompt to hunt for rootkits, memory-only malware, and active exploitation across every Windows, Linux, and macOS system in your enterprise.

Volexity@volexity.com

@volatilityfoundation.org

Registration for the upcoming Volexity Cyber Sessions in Amsterdam is nearly at capacity! Join us on October 29 for an afternoon of research and discussion, followed by dinner & drinks. Register now to secure your spot: luma.com/0qtkw49c Once we’re full, you can still join the waitlist.

Volexity@volexity.com

The full lineup for the Volexity Cyber Sessions in Amsterdam (Oct 29) is set! Talks cover Chrome & Windows vulnerabilities exploited by Chinese threat actors, edge device memory forensics, macOS lures & malware, and APTs targeting Europe in 2026. Seating is limited. Register here: luma.com/0qtkw49c

Volexity reposted

Volatility

Submissions are coming in for the 14th annual #Volatility #PluginContest! This is your chance to contribute to open source forensics, gain community-wide visibility for your work + win a cash prize! See the contest details here: volatilityfoundation.org/the-14th-ann... #dfir #memoryforensics

volexity.comA Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-DaysVolexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory p...

Volexity has discovered in-the-wild exploitation of a zero-day exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). The threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution.   #DFIR #threatintel

Notably, UTA0576 deployed no malware or web shell. Instead, they re-exploited the device for every command, returned results through HTTPS responses, and tampered with logs to stay hidden, evading Ivanti’s Integrity Checker Tool.

Volexity used its #Volcano memory analysis platform to uncover the full exploit chain and the attacker’s post-exploitation activity. Read the blog post for the full analysis, detection guidance & IOCs.

Join @attrc.bsky.social, Volexity’s Director of Research, at #BSidesNYC on Oct 17 at 10AM ET (Blue Track). In “Finding Evil Fast: Windows Memory Triage with Volatility 3,” he'll share five automated checks for quickly finding malicious activity in Windows memory.   #memoryforensics #dfir #volatility

bsidesnyc.orgEvent ScheduleBSides NYC is an Information / Security conference that’s different. We’re a 100% volunteer organized event put on by and for the community, and we truly strive to keep information free.

See the full #BSidesNYC conference schedule here: bsidesnyc.org/schedule/

Catch Volexity’s Josh Duke at #BSidesNYC on Oct 17 at 5PM ET (Other Track). Josh will present “No Safe Harbor: OceanLotus and ROGUEHARBOR,” sharing details from a recent #OceanLotus campaign that used WhatsApp to target human rights organizations and deploy the ROGUEHARBOR RAT.  #dfir #threatintel

See the full #BSidesNYC conference schedule here: bsidesnyc.org/schedule/

Steven Adair keynotes at our Volexity Cyber Sessions in Amsterdam (Oct 29) on Chinese APTs exploiting Chrome vulns fixed in Chromium but not released. Identical exploit code points to a shared supplier, plus a false-flag op pinning it on Russia. Seating is limited! Register here: luma.com/0qtkw49c

Feike Hacquebord will be speaking at our Volexity Cyber Sessions in Amsterdam (Oct 29) about Russia-, China- & DPRK-aligned APTs targeting Europe: IoT proxy networks, DPRK's Russian IPs, Pawn Storm's evolution & China's AI shift. Seating is limited! Register here: luma.com/0qtkw49c

22 Sept

Roey Shua will be speaking at our Volexity Cyber Sessions in Amsterdam (Oct 29) about automating edge device forensics, from fingerprinting unknown routers & IoT devices to reconstructing symbols and acquiring memory on unsupported architectures. Seating is limited! Register here: luma.com/0qtkw49c

volexity.comMind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day ExploitsOn September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2...

21 Sept

Following our Sept 9 blog on two Chinese APT actors chaining 0-days in Chrome (CVE-2026-85046, CVE-2026-87491) & Windows (CVE-2026-85880), Volexity found a third actor, UTA0565 using the same exploits Sept 3-4, while they were still unpatched.

@volatilityfoundation.org

21 Sept

UTA0565 used multiple fake websites, posing as media orgs & an NGO, to run a more customized version of the exploit framework than previously documented instances. The payload delivered was a new custom malware family, CLEANGULP, obfuscated using control flow flattening.

Volexity reposted

Volatility

21 Sept

Volatility New Release: #volatility3 v2.28.2 - visit github.com/volatilityfo... for details and downloads. #memoryforensics #dfir

17 Sept

Christopher Lopez will be speaking at our Volexity Cyber Sessions in Amsterdam (Oct 29) about the current macOS threat landscape: lures, targets, recently discovered malware, plus the artifacts that drive forensic analysis & durable detections. Seating is limited! Register here: luma.com/0qtkw49c

10 Sept

Volexity Volcano v26.09.01 expands what you can analyze, and where! This release adds a powerful MCP server, threat intel integration, memory support for Linux 7.x kernels and Windows 26H1 on Snapdragon X2 ARM64.

10 Sept

Volexity Volcano v26.09.01 also adds MFT parsing from disk, file magic detection, importing from GCP buckets, and complete AWS GovCloud support.

volexity.comDemo RequestVolexity’s solutions provide advanced analytics about the state of your devices and rapid insights into the risk those devices pose to your organization. These solutions are used by organizations acro...

10 Sept

volexity.comMind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & WindowsOn September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmenta...

9 Sept

Earlier this month, Volexity detected multiple Chinese threat actors launching attacks against its customers using chained 0-day exploits in Google Chrome (CVE-2026-85046 & CVE-2026-87491) and Microsoft Windows (CVE-2026-85880). #DFIR #threatintel

9 Sept

Volexity observed threat actors it tracks as UTA0560 and JungleBamboo using variations of the same exploits to deliver different malware implants. These implants ranged from a JScript backdoor (GRIMWEDGE) to a fake Google Gemini Chrome extension (LONGTALE).

@volatilityfoundation.org

9 Sept

Read the full analysis of the exploit chain and post-exploitation tradecraft here: www.volexity.com/blog/2026/09...

Volexity reposted

Volatility

13 Aug

The 14th annual #Volatility #PluginContest is officially OPEN! This is your chance to contribute to open source forensics, gain community-wide visibility for your work, and win a cash prize! See our blog post for details! Submission Deadline: 31 December 2026 #dfir #memoryforensics

volatilityfoundation.orgThe 14th Annual Volatility Plugin Contest is Open!We are excited to announce that the 14th Annual Volatility Plugin Contest is officially open for submissions! The annual Plugin Contest is your opportunity to: Directly contribute to the open sourc…

volexity.comSchedule a Meeting with Volexity in Las VegasIf you would like to schedule time with members of Volexity's leadership, development, engineering, or threat intelligence teams to learn more about our recent investigations and next-generation memor...

28 July

Heading to Las Vegas next week? Connect with our team to discuss the latest in #DFIR, #memoryforensics, active threat actor campaigns we're tracking, and more! Let us know when you'd like to meet: www.volexity.com/contact/meet...

Volexity@volexity.com

Volexity is heading to Las Vegas! Members of our leadership, development, engineering & threat intelligence teams will be on site August 4–6. If you would like to connect to discuss the latest in #DFIR, #memoryforensics, or the current threat landscape, let us know when you’d like to meet!

volexity.comCareersJoin a team where your contributions will have an impact on cybersecurity & develop concrete solutions to the most challenging real-world cyber problems.

22 July

Volexity is hiring! Join a team that develops concrete solutions to challenging real-world problems. Whether your focus is bringing new products to market or delivering cybersecurity services globally, the work you do here helps real people and moves the industry forward. See how you can plug in!

Volexity reposted

Thank you to @jags.bsky.social for the @volexity.com shout out in the latest Three Buddy Problem episode! If you aren't performing memory forensics in your environments, then you cannot make any definitive claims on whether you are compromised! podcasts.apple.com/us/podcast/h...

volexity.comProxying to Compromise: SonicWall Secure Mobile Access 0-day ExploitationIn early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised multiple of the customer's SonicWall Secure Mobil...

17 July

Volexity has published details on a recent incident response investigation involving exploitation of multiple #0day vulnerabilities in SonicWall SMA 1000 series appliances. This full technical breakdown includes vulnerability workflow, malware analysis & IOCs. #dfir #memoryforensics #threatintel

17 July

Volexity attributes this activity to a #threatactor it tracks as UTA0533, with the earliest signs of compromise dating back to June 22, 2026.

17 July

SonicWall has released patches (versions 12.4.3-03453 and 12.5.0-02835) following their July 14 public disclosure. Organizations using affected SMA 1000 series devices should upgrade immediately.

Volexity reposted

19 June

I am very excited to announce that my @volatilityfoundation.org 3 workshop with David McDonald and Pierre Breton was accepted for @defcon.bsky.social this summer!!

15 June

Great conversations at #FIRSTCON26 so far! Come say hello to the @volexity.com team at Booth 7 & see how to rapidly resolve your investigations and find what other tools are missing. #DFIR #FIRSTCON #memoryforensics

Volexity reposted

8 June

Memory forensics is a required technique to detect and respond to modern malware. Come see Volcano in action at FIRST next week to learn how memory forensics can be applied at true enterprise scale.

Volexity@volexity.com

Heading to Denver for #FIRSTCON26 next week? Stop by the @volexity.com booth to see a demo of Volcano! We’ll show you how memory analysis with Volcano uncovers advanced threat actors and helps rapidly resolve your investigations. #DFIR #FIRSTCON

Come find us at Booth 7 to talk threat hunting and triage workflows with our team, including @stevenadair.bsky.social & @attrc.bsky.social

Volexity reposted

volexity.comVerdantBamboo: Just Another BRICKSTORM in the FirewallIn September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The...

4 June

Our new blog post details our investigation into how a compromised MSP led to at least one of its customers being compromised, including deployment of the BRICKSTORM malware on multiple edge devices.

Volexity@volexity.com

@volexity.com has published details from an incident response engagement in September 2025 involving multiple #BRICKSTORM variants deployed by a threat actor that Volexity tracks as VerdantBamboo. [1/4]

VerdantBamboo used a #0day privilege escalation exploit in the process and was also observed using administrative access to the victim organization's firewall to enable a custom VPN. [3/4]

4 June

For more details on how the incident unfolded, the malware used by the threat actor, and the end goal of the intrusion, check out the full blog post: www.volexity.com/blog/2026/06... [4/4]

This case involved the breach of the victim organization’s MSP and multiple malware implants found on firewalls, cloud storage sync devices & NAS appliances. [2/4]

2 June

We are excited to welcome our 2026 #summerinternship students from Notre Dame Computer Science and Engineering, University of Maryland Department of Computer Science, and Maryland Applied Graduate Engineering!