Volexity

www.volexity.com Contact If you'd like to learn more about Volexity, please contact us!

Volexity Verified account @Volexity · Oct 29

The @Volexity Cyber Sessions event in Amsterdam is underway! Attendees are settling in for talks on threat intelligence, memory forensics, and incident response.

#dfir

View quoted post on X

Volexity Verified account @Volexity · Oct 13

.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.

Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.

Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/1…

#DFIR #threatintel #memoryforensics

View quoted post on X