APT Archives

Memory Forensics

Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP

October 16, 2026

Volexity Volcano Team

Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google […]

Threat Intelligence

A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

October 13, 2026

Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team

[Update: At the time of publication, Ivanti was in the process of developing a patch for the privilege escalation vulnerability described in this blog post. On October 29, 2026, Ivanti […]

Threat Intelligence

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

September 21, 2026

Damien Cash and Tom Lancaster

On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different […]

Threat Intelligence

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

September 9, 2026

Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster

On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). […]

Threat Intelligence

VerdantBamboo: Just Another BRICKSTORM in the Firewall

June 4, 2026

Damien Cash, Paul Rascagneres, Steven Adair, and Tom Lancaster

In September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The virtual machine […]

Threat Intelligence

Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

December 4, 2025

Matthew Meltzer, Steven Adair, and Tom Lancaster

In early 2025, Volexity published two blog posts detailing a new trend among Russian threat actors targeting organizations through the abuse of Microsoft 365 OAuth and Device Code authentication workflows to […]

Threat Intelligence

APT Meets GPT: Targeted Operations with Untamed LLMs

October 8, 2025

Callum Roxan, Killian Raimbaud, and Steven Adair

Starting in June 2025, Volexity detected a series of spear phishing campaigns targeting several customers and their users in North America, Asia, and Europe. The initially observed campaigns were tailored […]

Threat Intelligence

Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows

April 22, 2025

Charlie Gardner, Josh Duke, Matthew Meltzer, Sean Koessel, Steven Adair, and Tom Lancaster

Since early March 2025, Volexity has observed multiple suspected Russian threat actors conducting highly targeted social engineering operations aimed at gaining access to the Microsoft 365 (M365) accounts of targeted […]

Threat Intelligence

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

February 13, 2025

Charlie Gardner, Steven Adair, and Tom Lancaster

Starting in mid-January 2025, Volexity identified several social-engineering and spear-phishing campaigns by Russian threat actors aimed at compromising Microsoft 365 (M365) accounts. These attack campaigns were highly targeted and carried […]

Threat Intelligence

The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access

November 22, 2024

Sean Koessel, Steven Adair, and Tom Lancaster

In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had […]