To summarize: HuggingFace got compromised by a model from an American company. HF then tried to use American frontier model(s) to defend themselves, but were blocked by guardrails. HF then had to use open source Chinese models to defend themselves from an American org openai.com/index/huggin...

Thank you to @jags.bsky.social for the @volexity.com shout out in the latest Three Buddy Problem episode! If you aren't performing memory forensics in your environments, then you cannot make any definitive claims on whether you are compromised! podcasts.apple.com/us/podcast/h...

I am very excited to announce that my @volatilityfoundation.org 3 workshop with David McDonald and Pierre Breton was accepted for @defcon.bsky.social this summer!!

Great conversations at #FIRSTCON26 so far! Come say hello to the @volexity.com team at Booth 7 & see how to rapidly resolve your investigations and find what other tools are missing. #DFIR #FIRSTCON #memoryforensics

Memory forensics is a required technique to detect and respond to modern malware. Come see Volcano in action at FIRST next week to learn how memory forensics can be applied at true enterprise scale.

Volexity@volexity.com · 2mo ago

Heading to Denver for #FIRSTCON26 next week? Stop by the @volexity.com booth to see a demo of Volcano! We’ll show you how memory analysis with Volcano uncovers advanced threat actors and helps rapidly resolve your investigations. #DFIR #FIRSTCON

Our new blog post details our investigation into how a compromised MSP led to at least one of its customers being compromised, including deployment of the BRICKSTORM malware on multiple edge devices.

Volexity@volexity.com · 2mo ago

@volexity.com has published details from an incident response engagement in September 2025 involving multiple #BRICKSTORM variants deployed by a threat actor that Volexity tracks as VerdantBamboo. [1/4]

Memory-only malware leaves no trace on the file system and is commonly used by threat actors ranging from criminal organizations to ransomware operators to APT groups. In our Volatility 3 training, students gain deep hands on experience analyzing such threats: memoryanalysis.net/courses-malw...

SAVE THE DATE!! BSides Memphis will be hosted at Epicenter Memphis on October 3rd, 2026! More info to come on tickets, CFP, Sponsors, ect. please share so the local community knows this is happening!

Countdown is real ⌛️ Next week‼️ #ThreatResearch community gathers in Málaga 🇪🇸 Time to remind our PIVOTcon song: soundcloud.com/argonix/pivo... But watch out — it's a banger! #CTI #ThreatIntel #PIVOTcon26

a man in a white sweater is playing a keyboard with a vase of flowers in the background

ALT: a man in a white sweater is playing a keyboard with a vase of flowers in the background

media.tenor.com

I am excited to announce that I will be speaking at BSides Nashville on May 15th. Be sure to attend to see all the latest Volatility 3 (@volatilityfoundation.org) plugins against the most sophisticated and devastating malware from the wild! bsidesnash.org

Memory-only malware leaves no trace on the file system and is commonly used by threat actors ranging from criminal organizations to ransomware operators to APT groups. In our Volatility 3 training, students gain deep hands on experience analyzing such threats: memoryanalysis.net/courses-malw...

We are excited to announce the First Place winner of the 2025 #Volatility #PluginContest is: Daniel Baier for XRFM Inspector See the full Contest Results in our blog post: volatilityfoundation.org/the-2025-vol... Congrats to all winners & thank you to all participants! #DFIR #memoryforensics

The 2025 Volatility Plugin Contest results are in!

Results from the 13th Annual Volatility Plugin Contest are in! We received 8 submissions from 7 different countries that included 20 plugins. Contest submissions included a range of features…

volatilityfoundation.org

@volexity.com tracks a variety of threat actors abusing Device Code & OAuth authentication workflows to phish credentials, which continue to see success due to creative social engineering. Our latest blog post details Russian threat actor UTA0355’s campaigns impersonating European security events.

Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks

In early 2025, Volexity published two blog posts detailing a new trend among Russian threat actors targeting organizations through the abuse of Microsoft 365 OAuth and Device Code authentication workf...

volexity.com

@volexity.com has continued to see nation-state threat actors use AI + LLMs to assist in cyber attacks. Our recent research on a Chinese APT threat actor (UTA0388) using AI in its operation was something @stevenadair.bsky.social recently discussed with the @wsj.com.

The Wall Street Journal@wsj.com · 9mo ago

Exclusive: China’s state-sponsored hackers used Anthropic’s AI model to automate break-ins of major corporations and foreign governments.

We had a great day yesterday at #FTSCon 2025! FTSCon Week continues with @joegrand.bsky.social's Hardware Hacking Basics + #Volatility Malware & Memory Forensics training with @attrc.bsky.social, Michael Ligh + Dave Lassalle.

We would like to thank @volexity.com for sponsoring the #FTSCon 2025 Evening Reception, which will be at VUE Rooftop DC this year! If you haven’t registered for FTSCon yet, there’s still time! Registration closes Sunday Oct 12; learn more + register here: volatilityfoundation.org/from-the-sou...

The full lineup for our From the Source event is out! The event take places on October 20th in Arlington, VA. Joe Grand will keynote followed by an amazing speaker line up across two tracks. All proceeds will be donated to Connect Our Kids. volatilityfoundation.org/from-the-sou...

From The Source 2025

Learn Directly from the World’s Leading Digital Investigators: On Monday, October 20, 2025, the Volatility Foundation is hosting From The Source, a one-day summit, in Arlington, VA, followed by fou…

volatilityfoundation.org

With Volcano, security teams can automate the entire workflow of acquisition of memory and select files to deep analysis to automated alerts that directly point to signs of memory only malware and attacker activity throughout RAM and key artifacts sources from disk.

Volexity@volexity.com · 10mo ago

@volexity.com Volcano Server & Volcano One v25.09.21 adds memory analysis support for ARM64 Linux, macOS 26 (Tahoe) & Windows 25H2, plus 75+ new YARA rules, 10+ new IOCs, analysis of udev rules & rolling upgrades for managed endpoints. For more information, contact us: volexity.com/company/cont...

#FTSCon Speaker Spotlight: Joe FitzPatrick (@securelyfitz.bsky.social) is presenting “Rethinking DMA Attacks with Erebus” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

#FTSCon Speaker Spotlight: Andrew Case (@attrc.bsky.social) is presenting “Detection and Analysis of Memory-Only Linux Rootkits” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

I am very happy to announce that @volexity.com will be well represented at @bsidesnyc.org! David McDonald will be speaking on his latest automated Powershell Deobfuscation research & I will present the latest Volatility 3 advancements against sophisticated Windows malware: bsidesnyc.org/schedule/

The next in-person offering of our Malware and Memory Forensics Training will be held in Arlington, VA from Oct 21st-24th. This course has converted to Volatility 3, and all the material and labs are updated to cover the latest threats & analysis techniques memoryanalysis.net/courses-malw...

Malware and Memory Forensics Training - Memory Analysis

Malware and memory forensics training courses offered by the Memory Analysis Team.

memoryanalysis.net

The next in-person offering of our Malware and Memory Forensics Training will be held in Arlington, VA from Oct 21st-24th. This course has converted to Volatility 3, and all the material and labs are updated to cover the latest threats & analysis techniques memoryanalysis.net/courses-malw...

Malware and Memory Forensics Training - Memory Analysis

Malware and memory forensics training courses offered by the Memory Analysis Team.

memoryanalysis.net

At @bsidesorl.bsky.social, David McDonald and I will be delivering a hands-on workshop on using @volatilityfoundation.org 3 to detect sophisticated, memory-only malware as seen in the wild. Sign up ASAP before it fills!

BSides Orlando@bsidesorl.bsky.social · 11mo ago

🧰Workshop: Defeating Modern Malware by Andrew Case Learn hands-on memory forensics w/ Volatility 3 to detect & triage advanced malware used by APT & ransomware groups. https://bsorl.org/workshops

CYBERWARCON is coming!!! Registration and CFP are now open for this year's #CYBERWARCON! This year's keynote speaker will be @dmitri.silverado.org!! We are back in Arlington, VA this year on November 19th. www.cyberwarcon.com

CYBERWARCON

cyberwarcon.com

If you will be at @bsideslv.org on Monday, then be sure to check out David's talk on automated detection and de-obfuscation of malicious Powershell scripts! bsideslv.org/talks#LBQDEB

Talks - BSides Las Vegas

BSides Las Vegas is a nonprofit organization formed to stimulate the Information Security industry and community.

bsideslv.org

This training course will be led by Andrew Case @attrc.bsky.social, Michael Ligh & Dave Lassalle. This is a great opportunity to gain valuable knowledge about #Volatility3 + learn all about #memoryforensics from Volatility core developers! Seats are filling up quickly so don't wait!

Volatility@volatilityfoundation.org · last yr.

The next in-person Malware & Memory Forensics Training will be in Arlington VA, October 21–24, 2025! This is the only #memoryforensics course taught directly by the Volatility developers. Course registration includes a pass to #FTSCon! Course details: memoryanalysis.net/courses-malw...

I am *very* excited to announce that the workshop I submitted to @defcon.bsky.social along with @lsu.bsky.social PhD students, Lauren Pace and Daniel Donze, was accepted!!! We will teach you how to automatically detect and analyze the sophisticated, memory-only malware techniques used in the wild.

I am excited to announce that I will be speaking at @hou-sec-con.bsky.social at the end of September in Houston! Be sure to check out my talk on Tuesday morning and my friend @mayahustle.bsky.social's talk on Wednesday afternoon. Full agenda at the following link: web.cvent.com/event/9ba9c5...

Super excited to help @attrc.bsky.social teach memory forensics at a @defcon.bsky.social workshop this year! I'll also be at @bsideslv.org earlier in the week as well so if you run into me please say hi! (And I will have cool stickers)

@lsuresearch.bsky.social · last yr.

#LSU cyber students will teach new ways to fight malware at the world’s largest and longest-running hacking conference @defcon.bsky.social www.lsu.edu/blog/2025/06... #ScholarshipFirst #WBTTW @lsu.bsky.social @lsuengineering.bsky.social @attrc.bsky.social @volexity.com @volatilityfoundation.org