.@Volexity has published the third and final installment of its Mind the (Patch) Gap series. Parts 1 and 2 detailed Volexity’s discovery of multiple Chinese threat actors chaining zero-day exploits in Google Chrome and Microsoft Windows to deploy malware. This post takes a closer look at Volexity Volcano, one of the most advanced tools behind those findings. The blog post also showcases Volcano’s new MCP server for AI-assisted incident response, threat hunting, and digital forensics. Volexity analysts used it to triage a compromised system, automatically annotate related artifacts, create new IOCs for future detection, and schedule targeted collections across endpoints. Read the full post here: volexity.com/blog/2026/10/16… #dfir #threatintel #memoryanalysis #memoryforensics

.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool. Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure. Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13… #DFIR #threatintel #memoryforensics