Threat Intelligence Archives

Threat Intelligence

Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

September 9, 2026

Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster

On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). […]

Threat Intelligence

BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA

November 15, 2024

Callum Roxan, Charlie Gardner, and Paul Rascagneres

[Update: At the time of publication, this vulnerability had not been addressed by Fortinet. On December 18, 2024, Fortinet published a public acknowledgement of the issue, affected versions, as well […]

Threat Intelligence

DISGOMOJI Malware Used to Target Indian Government

June 13, 2024

Volexity Threat Research

Note: Volexity has reported the activity described in this blog and details of the impacted systems to CERT at the National Informatics Centre (NIC) in India. In 2024, Volexity identified […]

Threat Intelligence

SharpTongue Deploys Clever Mail-Stealing Browser Extension “SHARPEXT”

July 28, 2022

Paul Rascagneres, Tom Lancaster, and Volexity Threat Research

Volexity tracks a variety of threat actors to provide unique insights and actionable information to its Threat Intelligence customers. One frequently encountered—that often results in forensics investigations on compromised systems—is […]

Threat Intelligence

DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach

June 15, 2022

Steven Adair, Tom Lancaster, and Volexity Threat Research

Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or […]

Threat Intelligence

Zero-Day Exploitation of Atlassian Confluence

June 2, 2022

Andrew Case, Sean Koessel, Steven Adair, Tom Lancaster, and Volexity Threat Research

UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to […]

Threat Intelligence

Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign

March 31, 2020

Volexity Threat Research

Beginning in May 2019, Volexity started tracking a new series of strategic web compromises that have been used in highly targeted attacks against Tibetan individuals and organizations by a Chinese […]