Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
Summary: Volexity detailed how its Volcano memory forensics platform, paired with Surge Collect Pro, reconstructed an intrusion by the Chinese threat actor UTA0560 that used zero-day exploits in Google Chrome and Microsoft Windows to download and run malware. Volexity researchers compromised a VM with the same exploit chain and payloads, captured RAM, registry hives, event logs, the USN journal and the MFT, and Volcano's built-in IOCs flagged memory-only components including reflectively loaded DLLs and shellcode in chrome.exe, while its MCP server let OpenAI's Codex client with GPT-6.1-Sol run triage, apply labels and create new IOCs.
Bottom line: The GRIMWEDGE-encoded JavaScript was recovered from free memory, or slack space, which Volexity notes is inaccessible to standard EDR or antivirus tools and nearly impossible for an attacker to erase without destabilizing the system. If your detection stack stops at the endpoint agent, that evidence is sitting on machines you already own and you are not looking at it.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026