Exploit Archives

Memory Forensics

Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP

October 16, 2026

Volexity Volcano Team

Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google […]

Threat Intelligence

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits

September 21, 2026

Damien Cash and Tom Lancaster

On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different […]

Threat Intelligence

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

September 9, 2026

Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster

On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). […]

Threat Intelligence

The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access

November 22, 2024

Sean Koessel, Steven Adair, and Tom Lancaster

In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had […]

Memory Forensics

Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices

May 15, 2024

Volexity Threat Research

Last month, Volexity reported on its discovery of zero-day, in-the-wild exploitation of CVE-2024-3400 in the GlobalProtect feature of Palo Alto Networks PAN-OS by a threat actor Volexity tracks as UTA0218. Palo […]

Threat Intelligence

Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)

April 12, 2024

Volexity Threat Research

Volexity would like to thank Palo Alto Networks for their partnership, cooperation, and rapid response to this critical issue. Their research can be found here. On April 10, 2024, Volexity […]

Memory Forensics

How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities

February 1, 2024

Andrew Case, Michael Hale Ligh, and Volexity Volcano Team

In a recent series of blog posts related to two zero-day vulnerabilities in Ivanti Connect Secure VPN, Volexity shared details of active in-the-wild exploitation; provided an update on how exploitation […]

Threat Intelligence

Ivanti Connect Secure VPN Exploitation: New Observations

January 18, 2024

Matthew Meltzer, Sean Koessel, and Steven Adair

On January 15, 2024, Volexity detailed widespread exploitation of Ivanti Connect Secure VPN vulnerabilities CVE-2024-21887 and CVE-2023-46805. In that blog post, Volexity detailed broader scanning and exploitation by threat actors […]

Threat Intelligence

Ivanti Connect Secure VPN Exploitation Goes Global

January 15, 2024

Cem Gurkok, Paul Rascagneres, Sean Koessel, Steven Adair, and Tom Lancaster

Important: If your organization uses Ivanti Connect Secure VPN and you have not applied the mitigation, then please do that immediately! Organizations should immediately review the results of the built-in […]

Threat Intelligence

Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN

January 10, 2024

Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, and Tom Lancaster

Volexity has uncovered active in-the-wild exploitation of two vulnerabilities allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. An official security advisory and knowledge base article have been […]