Covers: Detection & ResponseThreat Actors & Nation-StatePhishing & Social EngineeringMalwareVulnerabilities & PatchingSupply Chain & AppSecZero-Days & ExploitsData BreachesPrivacy
Volexity describes its Threat Intelligence service as a mix of detailed reporting, single-value IOCs, and complex signatures drawn from its incident response and network security monitoring engagements. The offering includes an API and commercial...
Volexity's services overview describes customized threat intelligence, around-the-clock critical infrastructure protection, and incident response work that sizes, scopes, contains, and remediates incidents. The firm says it tracks advanced threat groups'...
Starting in mid-January 2025, Volexity identified spear-phishing and social-engineering campaigns by Russia-based threat actors targeting Microsoft 365 accounts, all using Device Code Authentication to gain long-term account access. Volexity tracks the...
In 2022, Volexity partnered with the University of Applied Sciences Leiden to establish a 20-week Minor Memory and Malware Forensics program, onboarding two Dutch interns, Lukas van Rijn and Anthony Branger, in February 2022 after they completed the...
Andrew Case presented a May 2023 Volexity Cyber Sessions talk on detecting and triaging modern Windows rootkits, covering techniques that rootkit developers adapted to evade Microsoft's newer kernel protections, including Driver Signing Enforcement enabled...
Steven Adair of Volexity gave a September 2019 Volexity Cyber Sessions talk on OceanLotus, described as one of the most advanced and pervasive threat groups active today, covering how it manages tracking, exploitation, and command and control operations...
Tom Lancaster presented a May 2023 Volexity Cyber Sessions talk covering two real-world cases of Chinese nation-state attackers using 0-day exploits to compromise firewall devices. The talk explains how the attacks were detected and the investigation...
Andrew Case, a Volatility core developer, presented an online Volexity Cyber Session in April 2020 introducing a pre-release of Volatility 3, an entirely new version of the memory forensics framework. The talk compares the new framework to previous...
Volexity describes an M&A security assessment in which a global industrial technology company acquiring another firm engaged Volexity to evaluate the prospect's cybersecurity posture. Using Network Security Sensors to analyze traffic for malware beaconing...
Volexity released GoResolver, an open-source tool that uses control-flow graph similarity to recover original package and function names from Golang binaries obfuscated with tools such as Garble. The tool fingerprints the Go runtime version by testing only...
Since early March 2025, Volexity has tracked at least two suspected Russian threat actors, UTA0352 and UTA0355, running targeted social engineering against Microsoft 365 accounts by abusing legitimate OAuth 2.0 authentication workflows rather than Device...
Andrew Case of Volexity gave a September 2019 Cyber Sessions talk on Windows 10 features that change what evidence digital forensic and incident response investigators can find on disk and in memory. The features cited include new event logging sources,...
Volexity released a new IDA Pro and Ghidra plugin called GoStringExtractor and added runtime type information (RTTI) parsing to its existing GoResolver tool, aimed at analyzing obfuscated and unobfuscated Golang malware samples. The company noted that a...
Volexity tracked a China-aligned actor it calls UTA0388 running spear phishing campaigns against customers in North America, Asia, and Europe from June 2025, using fabricated researcher identities and links to remotely hosted ZIP or RAR archives that...
Volexity attributes two 2025 phishing campaigns to the Russian threat actor UTA0355, which built fake websites impersonating the Belgrade Security Conference and the Brussels Indo-Pacific Dialogue to lure registrants into Microsoft 365 OAuth and Device...
Volexity's September 2025 incident response found a Chinese threat actor it tracks as VerdantBamboo (WARP PANDA, UNC5221) had compromised an Egnyte Storage Sync appliance using valid SSH credentials for the default egnyteservice account, deploying the...
Volexity investigated two compromised SonicWall Secure Mobile Access VPN appliances, models 6210, 7210 and 8200v, and found a threat actor it tracks as UTA0533 using a chain of multiple zero-day exploits, with the earliest sign of compromise on June 22,...
Volexity detected a September 1, 2026 spear-phishing campaign by Chinese threat actor UTA0560 targeting NGO customers, using reflected XSS on a US university website to redirect victims to a chain exploiting Chrome zero-day CVE-2026-85046, a V8...
Volexity reported that a third Chinese threat actor it tracks as UTA0565 used chained Chrome zero-days (CVE-2026-85046, CVE-2026-87491) and a Windows local privilege escalation flaw (CVE-2026-85880) on September 3-4, 2026, while the vulnerabilities were...
Volexity discovered threat actor UTA0576 exploiting a zero-day chain in a fully patched Ivanti Connect Secure VPN appliance (version 22.8R2.4) starting October 3, 2026, combining an authentication bypass, remote code execution, and privilege escalation to...
Volexity detailed how its Volcano memory forensics platform, paired with Surge Collect Pro, reconstructed an intrusion by the Chinese threat actor UTA0560 that used zero-day exploits in Google Chrome and Microsoft Windows to download and run malware....