Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-10-13 ⋅ Volexity ⋅ Steven Adair
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
2026-07-17 ⋅ Volexity ⋅ Sean Koessel, Steven Adair
Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
Behinder UTA0533
2025-10-08 ⋅ Volexity ⋅ Callum Roxan, Killian Raimbaud, Steven Adair
APT Meets GPT: Targeted Operations with Untamed LLMs
UTA0388
2025-04-22 ⋅ Volexity ⋅ Charlie Gardner, Josh Duke, Matthew Meltzer, Sean Koessel, Steven Adair, Tom Lancaster
Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows
UTA0352 UTA0355
2025-02-13 ⋅ Volexity ⋅ Charlie Gardner, Steven Adair, Tom Lancaster
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
2024-11-22 ⋅ Volexity ⋅ Sean Koessel, Steven Adair, Tom Lancaster
The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access
APT28
2024-11-15 ⋅ Volexity ⋅ Callum Roxan, Charlie Gardner, Paul Rascagnères
BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA
lightSpy LIGHTSPY BH_A006 DEEPDATA DEEPPOST BrazenBamboo
2024-08-02 ⋅ Volexity ⋅ Ankur Saini, Paul Rascagnères, Steven Adair, Thomas Lancaster
StormBamboo Compromises ISP to Abuse Insecure Software Update Mechanisms
CDDS DUSTPAN MgBot
2024-06-13 ⋅ Volexity ⋅ Volexity Threat Research
DISGOMOJI Malware Used to Target Indian Government
2024-04-12 ⋅ Volexity ⋅ Volexity Threat Research
Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
UPSTYLE UTA0218
2024-02-13 ⋅ Volexity ⋅ Ankur Saini, Callum Roxan, Charlie Gardner, Damien Cash
CharmingCypress: Innovating Persistence
BASICSTAR Charming Kitten
2024-01-10 ⋅ Volexity ⋅ Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, Thomas Lancaster
Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN
UTA0178
2023-06-28 ⋅ Volexity ⋅ Ankur Saini, Charlie Gardner
Charming Kitten Updates POWERSTAR with an InterPlanetary Twist
POWERSTAR
2023-03-30 ⋅ Volexity ⋅ Ankur Saini, Callum Roxan, Charlie Gardner, Paul Rascagnères, Steven Adair, Thomas Lancaster
3CX Supply Chain Compromise Leads to ICONIC Incident
3CX Backdoor IconicStealer
2023-03-07 ⋅ Volexity ⋅ Paul Rascagnères
Using Memory Analysis to Detect EDR-Nullifying Malware
2022-06-15 ⋅ Volexity ⋅ Steven Adair, Thomas Lancaster, Volexity Threat Research
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
pupy Sliver DriftingCloud
2022-03-22 ⋅ Volexity ⋅ Damien Cash, Steven Adair, Thomas Lancaster
Storm Cloud on the Horizon: GIMMICK Malware Strikes at macOS
GIMMICK GIMMICK
2022-02-03 ⋅ Volexity ⋅ Steven Adair, Thomas Lancaster
Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
TEMP_Heretic
2021-12-07 ⋅ Volexity ⋅ Volexity Threat Research
XE Group – Exposed: 8 Years of Hacking & Card Skimming for Profit
2021-08-24 ⋅ Volexity ⋅ Damien Cash, Josh Grunzweig, Steven Adair, Thomas Lancaster
North Korean BLUELIGHT Special: InkySquid Deploys RokRAT
RokRAT