Blog | Threat Intelligence & Memory Forensics

Memory Forensics

Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP

October 16, 2026

Volexity Volcano Team

Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google […]

Threat Intelligence

A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

October 13, 2026

Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team

Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to […]

Threat Intelligence

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

September 21, 2026

Damien Cash and Tom Lancaster

On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different […]

Threat Intelligence

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

September 9, 2026

Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster

On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). […]

Threat Intelligence

Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

July 17, 2026

Sean Koessel and Steven Adair

In early July 2026, Volexity was engaged to perform an incident response investigation where it discovered a threat actor had successfully compromised SonicWall Secure Mobile Access (SMA) VPN appliances through […]

Threat Intelligence

VerdantBamboo: Just Another BRICKSTORM in the Firewall

June 4, 2026

Damien Cash, Paul Rascagneres, Steven Adair, and Tom Lancaster

In September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The virtual machine […]

Threat Intelligence

Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

December 4, 2025

Matthew Meltzer, Steven Adair, and Tom Lancaster

In early 2025, Volexity published two blog posts detailing a new trend among Russian threat actors targeting organizations through the abuse of Microsoft 365 OAuth and Device Code authentication workflows to […]

Threat Intelligence

APT Meets GPT: Targeted Operations with Untamed LLMs

October 8, 2025

Callum Roxan, Killian Raimbaud, and Steven Adair

Starting in June 2025, Volexity detected a series of spear phishing campaigns targeting several customers and their users in North America, Asia, and Europe. The initially observed campaigns were tailored […]

Volexity Blog

Published research by Volexity's Threat Intelligence and Incident Response teams, as well as topics covering memory analysis and memory forensics.