@volexity.com tracks a variety of threat actors abusing Device Code & OAuth authentication workflows to phish credentials, which continue to see success due to creative social engineering. Our latest blog post details Russian threat actor UTA0355’s campaigns impersonating European security events.

@volexity.com has continued to see nation-state threat actors use AI + LLMs to assist in cyber attacks. Our recent research on a Chinese APT threat actor (UTA0388) using AI in its operation was something @stevenadair.bsky.social recently discussed with the @wsj.com.

We had a great day yesterday at #FTSCon 2025! FTSCon Week continues with @joegrand.bsky.social's Hardware Hacking Basics + #Volatility Malware & Memory Forensics training with @attrc.bsky.social, Michael Ligh + Dave Lassalle.

We would like to thank @volexity.com for sponsoring the #FTSCon 2025 Evening Reception, which will be at VUE Rooftop DC this year! If you haven’t registered for FTSCon yet, there’s still time! Registration closes Sunday Oct 12; learn more + register here: volatilityfoundation.org/from-the-sou...

The full lineup for our From the Source event is out! The event take places on October 20th in Arlington, VA. Joe Grand will keynote followed by an amazing speaker line up across two tracks. All proceeds will be donated to Connect Our Kids. volatilityfoundation.org/from-the-sou...

With Volcano, security teams can automate the entire workflow of acquisition of memory and select files to deep analysis to automated alerts that directly point to signs of memory only malware and attacker activity throughout RAM and key artifacts sources from disk.

#FTSCon Speaker Spotlight: Joe FitzPatrick (@securelyfitz.bsky.social) is presenting “Rethinking DMA Attacks with Erebus” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Andrew Case (@attrc.bsky.social) is presenting “Detection and Analysis of Memory-Only Linux Rootkits” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

I am very happy to announce that @volexity.com will be well represented at @bsidesnyc.org! David McDonald will be speaking on his latest automated Powershell Deobfuscation research & I will present the latest Volatility 3 advancements against sophisticated Windows malware: bsidesnyc.org/schedule/

The next in-person offering of our Malware and Memory Forensics Training will be held in Arlington, VA from Oct 21st-24th. This course has converted to Volatility 3, and all the material and labs are updated to cover the latest threats & analysis techniques memoryanalysis.net/courses-malw...

The next in-person offering of our Malware and Memory Forensics Training will be held in Arlington, VA from Oct 21st-24th. This course has converted to Volatility 3, and all the material and labs are updated to cover the latest threats & analysis techniques memoryanalysis.net/courses-malw...

At @bsidesorl.bsky.social, David McDonald and I will be delivering a hands-on workshop on using @volatilityfoundation.org 3 to detect sophisticated, memory-only malware as seen in the wild. Sign up ASAP before it fills!

CYBERWARCON is coming!!! Registration and CFP are now open for this year's #CYBERWARCON! This year's keynote speaker will be @dmitri.silverado.org!! We are back in Arlington, VA this year on November 19th. www.cyberwarcon.com

If you will be at @bsideslv.org on Monday, then be sure to check out David's talk on automated detection and de-obfuscation of malicious Powershell scripts! bsideslv.org/talks#LBQDEB

This training course will be led by Andrew Case @attrc.bsky.social, Michael Ligh & Dave Lassalle. This is a great opportunity to gain valuable knowledge about #Volatility3 + learn all about #memoryforensics from Volatility core developers! Seats are filling up quickly so don't wait!

I am *very* excited to announce that the workshop I submitted to @defcon.bsky.social along with @lsu.bsky.social PhD students, Lauren Pace and Daniel Donze, was accepted!!! We will teach you how to automatically detect and analyze the sophisticated, memory-only malware techniques used in the wild.

I am excited to announce that I will be speaking at @hou-sec-con.bsky.social at the end of September in Houston! Be sure to check out my talk on Tuesday morning and my friend @mayahustle.bsky.social's talk on Wednesday afternoon. Full agenda at the following link: web.cvent.com/event/9ba9c5...

Super excited to help @attrc.bsky.social teach memory forensics at a @defcon.bsky.social workshop this year! I'll also be at @bsideslv.org earlier in the week as well so if you run into me please say hi! (And I will have cool stickers)

#LSU cyber students will teach new ways to fight malware at the world’s largest and longest-running hacking conference @defcon.bsky.social www.lsu.edu/blog/2025/06... #ScholarshipFirst #WBTTW @lsu.bsky.social @lsuengineering.bsky.social @attrc.bsky.social @volexity.com @volatilityfoundation.org

With Volcano for analysis and Surge Collect Pro for acquisition, you can automatically check your critical systems for signs of malware and attacker toolkits across memory and key artifact sources from disk. Contact us if you would like to schedule a virtual demo or one in person in Vegas!

I am *very* excited to announce that the workshop I submitted to @defcon.bsky.social along with @lsu.bsky.social PhD students, Lauren Pace and Daniel Donze, was accepted!!! We will teach you how to automatically detect and analyze the sophisticated, memory-only malware techniques used in the wild.

The CFP for our 2nd annual From the Source event is now open! The event includes two tracks, the first for Makers of open source DFIR tools and the second for Hunters who have performed the most interesting investigations of the last year. volatilityfoundation.org/announcing-f...

Our highly popular and technical training, "Malware and Memory Forensics with Volatility", has been fully converted to @volatilityfoundation.org 3 and significantly updated, including many new sections and 8 new, in-depth labs. Available online & in VA in October memoryanalysis.net/courses-malw...

I tried to strike a balance in this story between the dangers I was hearing about AI-assisted and "vibe coded" software and the hard, cold reality that there's probs no going back and this is going to be (if it isn't already) the "new normal" for huge chunks of software development. Check it out!

I will be showing off Volatility 3 during my talk on Wednesday afternoon at RVASec. Be sure to attend and come say hello if you will be around! rvasec.com/rvasec-14-sp...

I will be showing off Volatility 3 during my talk on Wednesday afternoon at RVASec. Be sure to attend and come say hello if you will be around! rvasec.com/rvasec-14-sp...

We are VERY excited to announce that Volatility 3 has now reached feature parity with Volatility 2! With this parity release, Volatility 2 is now deprecated. Full details in the blog post linked below.

Check out this great research and new open source tool by our threat intel team!

I will be speaking at @kernelcon.bsky.social on Fri, Apr 3rd. The talk will cover previously-unreported features of the sedexp Linux malware found in the wild - including loading of a memory-only rootkit! Talk will cover how the rootkit was discovered & how to analyze with @volatilityfoundation.org

We are excited to present our #PIVOTcon25 #Keynote speaker: Jackie Burns Koven! She is Head of Cyber Threat Intelligence at @chainalysis.bsky.social where her team tracks the wallets of those who scam, steal, and extort for cryptocurrency 💰💸🦹 #CTI #ThreatIntel (1/4)

Six days away! I am very much looking forward to speaking in San Diego next weekend!

The sedexp Linux malware was disclosed in late 2024. In my talk at @kernelcon.bsky.social, I will present my own deep dive of the malware, including many parts that have not been made public, such as loading of a memory-only rootkit. Be sure to attend for a teardown with @volatilityfoundation.org 3!

I will be speaking at @kernelcon.bsky.social on Fri, Apr 3rd. The talk will cover previously-unreported features of the sedexp Linux malware found in the wild - including loading of a memory-only rootkit! Talk will cover how the rootkit was discovered & how to analyze with @volatilityfoundation.org

The 2005 DFRWS Windows memory forensics challenge spawned a generation of DFIR researchers, and the 2008 Linux challenge is what led me to @volatilityfoundation.org. The 25th anniversary event will be held in Chicago this summer and promises to be an incredible time: dfrws.org/dfrws-jubile...

On March 29th, I will be speaking at @bsidessd.bsky.social on Volatility 3, including all its new features and plugins. Be sure to attend to catch a sneak peak at the new framework before the major release later this Spring! www.bsidessd.org #DFIR #infosec

I will be attending RE//verse next weekend in Orlando. Let me know if you will be around and want to meet up: re-verse.io

Check out this awesome work by our threat intel team!

If you will be at @wildwesthackinfest.bsky.social next week then be sure to attend my talk!

On Thursday, Feb 6, @attrc.bsky.social will be at @wildwesthackinfest.bsky.social to present "Effectively Detecting Modern Code Injection Techniques with Volatility 3". Conference agenda: wildwesthackinfest.com/wild-west-ha.... 

 #dfir #memoryforensics #Volatility3 @volatilityfoundation.org

The deadline for paper submissions to the 25th Annual DFRWS USA is quickly approaching - January 20th for abstracts and 27th for full papers - submit ASAP! dfrws.org/conferences/... #DFIR #infosec

@volexity.com’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target while the attacker was halfway around the world.    Read more here: www.volexity.com/blog/2024/11...

Russian spies—likely Russia's GRU intelligence agency—used a new trick to hack a victim in Washington, DC: They remotely infected another network in a building across the street, hijacked a laptop there, then breached the target organization via its Wifi. www.wired.com/story/russia...

A long blog post will eventually drop about this case and it will be one of the craziest DFIR stories in history! If you can see the talk in person then do it!!

I created the ICS/OT Security starter pack. Please give it a follow and let me know if I'm missing anyone. go.bsky.app/SQygf7K

This thread 🧵 on NSO Group revelations from recent legal filings is one raised eyebrow after another.

Our talk from @defcon.bsky.social is now available! In the presented research, we document every EDR bypass technique used in the wild along with how to detect it using new memory forensics techniques and Volatility plugins. Feedback appreciated! www.youtube.com/watch?v=Pmqv...

Check out the back of my new favorite @volexity.bsky.social shirt that I acquired at FTSCon! Using memory forensics to find 0days in network appliances and high value applications will never get old!

Our talk from @defcon.bsky.social is now available! In the presented research, we document every EDR bypass technique used in the wild along with how to detect it using new memory forensics techniques and Volatility plugins. Feedback appreciated! www.youtube.com/watch?v=Pmqv...