Pinned Tweet
If you're looking into the newest SonicWall exploitation (CVE-2026-15409 & CVE-2026-15410), the Volexity blog is a must read:
volexity.com/blog/2026/07/17…
tlansec retweeted
Registration for the upcoming @Volexity Cyber Sessions in Amsterdam is nearly at capacity! Join us on October 29 for an afternoon of research and discussion, followed by dinner & drinks.
Register now to secure your spot: luma.com/0qtkw49c
Once we’re full, you can still join the waitlist.
The full speaker lineup for our upcoming @Volexity Cyber Sessions in Amsterdam is set!
Join us on October 29 and learn about Chrome and Windows vulnerabilities exploited by Chinese threat actors, including Chrome bugs fixed upstream but not yet released (@stevenadair); agentic memory forensics for routers and other edge devices (Roey Shua); the lures and recently discovered malware families shaping the macOS threat landscape (@L0Psec); and how state-aligned actors are targeting Europe in 2026 (@FeikeHacquebord).
Seating is limited and registration closes when we reach capacity. Register now to secure your spot: luma.com/0qtkw49c
#DFIR #threatintel #apt #memoryforensics #iot
tlansec retweeted
We just posted a new blog from our product (Volcano) team! This showcases how we use @Volexity's software solutions to collect and analyze memory and other key file artifacts. We have added a lot of awesome new features to our products recently and the team is showcasing how they all come together to facilitate investigations. If you are wondering how we operate or how you could be stepping up your acquisition and analysis capabilities -- have a look!
.@Volexity has published the third and final installment of its Mind the (Patch) Gap series. Parts 1 and 2 detailed Volexity’s discovery of multiple Chinese threat actors chaining zero-day exploits in Google Chrome and Microsoft Windows to deploy malware. This post takes a closer look at Volexity Volcano, one of the most advanced tools behind those findings.
The blog post also showcases Volcano’s new MCP server for AI-assisted incident response, threat hunting, and digital forensics. Volexity analysts used it to triage a compromised system, automatically annotate related artifacts, create new IOCs for future detection, and schedule targeted collections across endpoints.
Read the full post here: volexity.com/blog/2026/10/16…
#dfir #threatintel #memoryanalysis #memoryforensics
tlansec retweeted
.@Volexity has published the third and final installment of its Mind the (Patch) Gap series. Parts 1 and 2 detailed Volexity’s discovery of multiple Chinese threat actors chaining zero-day exploits in Google Chrome and Microsoft Windows to deploy malware. This post takes a closer look at Volexity Volcano, one of the most advanced tools behind those findings.
The blog post also showcases Volcano’s new MCP server for AI-assisted incident response, threat hunting, and digital forensics. Volexity analysts used it to triage a compromised system, automatically annotate related artifacts, create new IOCs for future detection, and schedule targeted collections across endpoints.
Read the full post here: volexity.com/blog/2026/10/16…
#dfir #threatintel #memoryanalysis #memoryforensics
tlansec retweeted
New from @saffronsec on @bindinghook
What does the Iran war tell us about the relationship between cyber and kinetic conflict?
bindinghook.com/what-does-th…
tlansec retweeted
is there a word for the feeling in threat research / threat intel, for after you found some really cool stuff, but now its back to normal and you're just dealing with vibe coded phish kits?
Yesterday was a bumper day in terms of vulnerabilities for the @Volexity team.
The main action can be read about on our blog here, with Ivanti: volexity.com/blog/2026/10/13…
but a Microsoft LPE vulnerability we found also got patched: msrc.microsoft.com/update-gu…
tlansec retweeted
Our services team found multiple Ivanti Connect Secure 0days being exploited in the wild and against one of our Network Security Monitoring customers. The blog has the full attack details and IOCs!
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.
Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.
Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13…
#DFIR #threatintel #memoryforensics
tlansec retweeted
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.
Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.
Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13…
#DFIR #threatintel #memoryforensics
tlansec retweeted
Edge devices (routers, IoT endpoints, network appliances) are increasingly central to intrusions, yet they remain among the hardest forensic targets. Roey Shua will be speaking at our upcoming Volexity Cyber Sessions in Amsterdam (October 29) about whether edge device forensics, and volatile memory analysis in particular, can be automated.
Roey will walk through an agentic framework that fingerprints an unknown networked device, selects a viable acquisition path for its architecture and kernel, and reconstructs the symbol information needed for analysis, including a proof-of-concept extending Volatility 3 to support a MIPS-based router it does not natively handle.
Seating is limited. Register now to secure your spot: luma.com/0qtkw49c
#dfir #memoryforensics #iot
tlansec retweeted
Catch @Volexity's Josh Duke at @BSidesNYC on Saturday, October 17 at 5:00 PM ET (Other Track). Josh will present “No Safe Harbor: OceanLotus and ROGUEHARBOR,” sharing details from a recent #OceanLotus campaign that used WhatsApp to target human rights organizations and deploy the ROGUEHARBOR RAT.
See the full conference schedule here: bsidesnyc.org/schedule/
#dfir #threatintel
tlansec retweeted
Join @attrc, Volexity’s Director of Research, at @BSidesNYC on Saturday, October 17 at 10:00 AM ET (Blue Track). In “Finding Evil Fast: Windows Memory Triage with Volatility 3,” he will share five automated checks for quickly finding malicious activity in Windows memory.
See the full conference schedule here: bsidesnyc.org/schedule/
#memoryforensics #dfir #volatility
tlansec retweeted
LAST DAY TO SUBMIT TO THE @CYBERWARCON CFP!
Some things I’d love to see submissions on:
💣 Destructive and disruptive cyber attackers. Especially those active in European sabotage and the Middle Eastern conflict. What’s going on with Volt Typhoon?
💣 Third parties roped into state cybershenanigans like criminals.
💣 Hack and leakers like COLD RIVER and CALANQUE ION.
💣 The state of info ops. What’s working?
💣 Targeting of IP cameras and other cyber espionage and surveillance efforts tied to physical targeting.
💣 Real case studies on the use of AI in state actor intrusions. Especially when those intrusions lead to disruptive and destructive scenarios.
We are looking for real world case studies that will illuminate the future of the threat. There is still time, but don’t dally!
tlansec retweeted
🆘 is almost two weeks away and features a STACKED agenda covering the latest developments and breakthroughs in state-sponsored operations.
SOS Volume II discusses developments in espionage & sabotage placing Russia, China, and Iran into center frame.
A thread...🧵
tlansec retweeted
I’ll be presenting at the @CERTEU Conference this week! Looking forward to meeting some new faces and catching up with old friends in Brussels!
🤖 Made with AI
tlansec retweeted
Hello
Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
tlansec retweeted
Storm-2945, a sub-cluster of the Russian state actor Midnight Blizzard, has resumed their CaptiveCrunch campaign. msft.it/6019aWMDf
First reported by Microsoft Threat Intelligence in July 2026, the campaign uses manipulated network traffic and captive portals in the hospitality sector to gain access to targets.
The renewed activity is consistent with reporting from Black Lotus Labs suggesting that multiple managed service providers are implicated; Storm-2945’s continued access to these upstream providers has likely enabled this rapid re-deployment.
We have updated our blog to provide more recent network infrastructure indicators, detections, and hunting guidance. We want to thank Google Threat Intelligence Group (GTIG) for their collaboration on tracking the reemergence of this activity.
