Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP

Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google Chrome and Microsoft Windows in campaigns that, if successful, would download and run malware on an exploited system. Those posts covered technical details of the exploits and malware Volexity observed, along with general detection methods for each case. Behind those findings was one of the most advanced tools in Volexity’s arsenal: Volexity Volcano.

Volexity Volcano provides rapid response capabilities and advanced detections across Windows, Linux, and macOS endpoints at enterprise scale. Recent releases integrate with Volexity’s Cyber Threat Intelligence feed for actionable, high-fidelity indicators of compromise (IOCs), and now include a game-changing MCP (Model Context Protocol) server for AI-assisted incident response, threat hunting, and digital forensics. Combined with Volcano’s unrivaled memory, file, and registry forensics, these features expedite investigations like those described in Part 1 and Part 2 of the blog series.

In this third installment of the series, Volexity takes a closer look at Volcano and the features that made that work possible.

Surge Collect Pro Acquisition

To demonstrate, Volexity researchers compromised a virtual machine (VM) with the same zero-day exploit chain and payloads used by UTA0560 as described in Part 1. After accessing and interacting with the VM, attackers realized the environment was monitored and attempted to clean up and cover their tracks. Volcano’s memory and file acquisition counterpart, Surge Collect Pro, was then used to capture the system’s memory (RAM), system and user registry hives, event logs, USN journal ($UsnJournal), master file table ($MFT), and other key forensic artifacts that Volcano incorporates into its analysis. The data collected by Surge Collect Pro was processed by Volcano, enabling reconstruction of attacker activity and analysis of related artifacts. The sections that follow detail the analysis and findings.

Threat Intelligence Feeds

Volcano ships with powerful IOCs that automatically bring suspicious artifacts to the analyst’s attention. Out of the box, these IOCs nailed the memory-only components, including reflectively loaded DLLs and position-independent shellcode in chrome.exe. They also triggered on the persistence mechanism and anomalies related to system privileges and invalid parent/child process relationships.

Volcano’s Volexity Threat Intel indicator complements the built-in IOCs with real-time lookups of malicious IP addresses, DNS names, and YARA rules from Volexity’s Cyber Threat Intelligence feeds. Volcano users that subscribe to these feeds benefit from advance notice of attacker infrastructure and thorough alerting across all evidence supplied to Volcano. In the example below, the malicious hostname cloud.shinewrist[.]net was detected in event logs and from the command line of the command shells and curl processes.

Initial Triage with Volcano’s MCP

Since its inception, Volcano was designed to save time by automating analyses, including collection import, memory profile identification, artifact extraction, and IOC scanning. It exposes powerful REST APIs, an OpenAPI specification, and a Python3 SDK for effortless integration with third-party applications and services. With the introduction of Volcano’s new MCP server, this already rapid process reaches new levels of efficiency and automation. AI-assisted investigations also make memory forensics technology more accessible to traditional forensic analysts, SOC operators, and other information security personnel.

In the following examples, Volexity analysts used OpenAI’s Codex client with GPT-6.1-Sol to connect to Volcano’s MCP. Other models (public and local) are viable, but your mileage may vary depending on the strength of the model.

Prompt: Read https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/. Then find the Chrome Exploit sample on Volcano. Are the "First Page Thread" IOC hits related to the 0-day? Be concise but specific - go deep if needed (read data and disassemble/analyze shellcode).

The affirmative response is below, in sufficient but not excruciating detail:

This initial triage also performed some highly technical work, which historically may have required a small team of seasoned forensic analysts and reverse engineers.

Deeper Triage and Auto-Annotations

The next example leverages MCP to automatically apply annotations (labels and notes) to artifacts in Volcano that match criteria specified in Volexity’s blog posts. While this feature was designed for real-time collaboration among users, it can extend to a team of AI agents as well.

Prompt: What other artifacts related to UTA0560 and GRIMWEDGE can you find in the sample? Create new labels prefixed with codex-* (such as codex-UTA0560) and apply them to artifacts along with brief notes to explain their role/significance. There could be hundreds or thousands, so focus on representative artifacts and unique evidence types - especially memory-only and volatile ones.

Here is a summary of the output:

As shown below, Volcano’s Alerts tab grouped by labels is now concentrated with context about state of the compromised machine:

Analysts can pivot from an alert to the respective tab that exposes complete details about the artifact, such as timestamps, associated usernames, and other attributes.

Breadth & Future Coverage with IOC Creation

Volcano can go deep: it has full access to physical memory, including process working sets, kernel space, and free/deallocated pages for tracking historical activity. However, this system was confirmed compromised long ago; now it’s a game of breadth and future detection. What other systems are affected? Volexity’s Network Security Monitoring can answer this in a heartbeat, but Volcano also plays a critical role, especially for host-based indicators. Volcano’s IOCs query over 300 artifact types in addition to matching strings, regular expressions, and YARA rules throughout RAM.

Prompt: Leveraging data from the blog and artifacts you found in the sample, create IOC(s) on Volcano for UTA0560, GRIMWEDGE and JungleBamboo so future evidence will be annotated automatically. For UTA0560 and GRIMWEDGE, use the labels you created before. Create a new label for JungleBamboo. In addition to query-based IOCs, create string- and YARA-based IOCs if appropriate. Volexity published additional indicators at https://github.com/volexity/threat-intel/tree/main/2026/2026-09-09%20Chrome.

Here is a summary of the work:

Volcano’s IOC repository is now extended to help cover these new artifacts, although only a subset of the new rules appears below. While most of them are Windows-only, since Windows is the primary target platform, generic infrastructure-based IOCs are also configured to alert on Linux and macOS evidence.

Re-running IOCs against the sample reveals many additional artifacts, not just a representative sampling as requested earlier in these demonstrations. The GRIMWEDGE-encoded JavaScript is among these new artifacts, as shown below. The highly volatile proof was found in free memory (aka “slack space”), which is inaccessible to standard endpoint detection & response (EDR) or antivirus solutions, and nearly impossible for threat actors to erase without causing system instability or raising additional red flags.

Agentic Sampling with Volcano Endpoint

Based on Surge Collect Pro technology, Volcano Endpoint is a cross-platform, persistent agent that streams to Volcano Server on demand. Emerging MCP tools expose template creation (what evidence to collect), endpoint management, and collection scheduling. For the purposes of this next demonstration, an endpoint group with one Windows Server was created on Volcano. Then, its Microsoft Edge browser was seeded with hxxps://cloud.shinewrist[.]net/foo/Files1.html to trigger one of the new IOCs.

Prompt: Create a new template that collects only registry hives and browser history files (copy the existing Browsers template) from Windows systems. Then schedule a collection (for now) using that template for all hosts in the Windows Servers endpoint group. Wait for the analyses to complete for up to 5 minutes. If any of the codex-* IOCs trigger, then schedule another collection including all files from the Browser + DFIR-Files templates plus memory.

Here is the Codex console output:

As shown below, Volcano’s web interface displays metadata from the two scheduled collections. The smaller-scoped initial file triage took only a couple seconds; this was intended to be a quick sampling to determine hosts worthy of follow up. Since an IOC triggered, the subsequent collection containing memory and many other files was scheduled.

Rather than closing the loop after the memory collection, a subsequent IOC scan could ensue, with new IOCs identified automatically and more rounds of threat detection and alerting.

Conclusion

When paired with Volexity’s Threat Intelligence feeds and AI models via MCP, Volcano becomes an even more powerful weapon in the defender’s toolset. The workflows previewed in this blog post represent a fraction of existing and established capabilities, with many more emerging in the next releases.

Acknowledgements

Volexity would like to thank OpenAI for their partnership via the Trusted Access for Cyber (TAC) program. OpenAI’s cyber models have allowed Volexity to drastically reduce its analysis time when it comes to investigating exploits and other incidents of this nature.

If you are interested in learning more about Volexity’s services, including Threat Intelligence, Network Security Monitoring and Incident Response, or our leading memory forensics solutions, Volexity Surge Collect Pro for memory acquisition and Volexity Volcano for memory analysis, please do not hesitate to contact us.