The Curious Engineer

All blogs / Security

Volexity

volexity.com

Volexity's cyber threat intelligence team reports on the latest developments in advanced persistent threats (APTs) and 0-days, as well as emerging threats and malware analysis.

Security

’15’20’25
Posts
66 from 24 Sep 2014 to 16 Oct 2026
Posting
monthly (7 in the last year)
Kind
company blog
Feed
https://www.volexity.com/feed/

2026 6

  1. Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
  2. A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
  3. Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
  4. Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
  5. Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation
  6. VerdantBamboo: Just Another BRICKSTORM in the Firewall

2025 6

  1. Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
  2. APT Meets GPT: Targeted Operations with Untamed LLMs
  3. Go Get ‘Em: Updates to Volexity Golang Tooling
  4. Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows
  5. GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
  6. Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

2024 11

  1. The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access
  2. BrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA
  3. StormBamboo Compromises ISP to Abuse Insecure Software Update Mechanisms
  4. DISGOMOJI Malware Used to Target Indian Government
  5. Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices
  6. Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
  7. CharmingCypress: Innovating Persistence
  8. How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities
  9. Ivanti Connect Secure VPN Exploitation: New Observations
  10. Ivanti Connect Secure VPN Exploitation Goes Global
  11. Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN

2023 4

  1. EvilBamboo Targets Mobile Devices in Multi-year Campaign
  2. Charming Kitten Updates POWERSTAR with an InterPlanetary Twist
  3. 3CX Supply Chain Compromise Leads to ICONIC Incident
  4. Using Memory Analysis to Detect EDR-Nullifying Malware

2022 7

  1. ₿uyer ₿eware: Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware
  2. Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925
  3. SharpTongue Deploys Clever Mail-Stealing Browser Extension “SHARPEXT”
  4. DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
  5. Zero-Day Exploitation of Atlassian Confluence
  6. Storm Cloud on the Horizon: GIMMICK Malware Strikes at macOS
  7. Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra

2021 5

  1. XE Group – Exposed: 8 Years of Hacking & Card Skimming for Profit
  2. North Korean BLUELIGHT Special: InkySquid Deploys RokRAT
  3. North Korean APT InkySquid Infects Victims Using Browser Exploits
  4. Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns
  5. Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

2020 6

  1. Responding to the SolarWinds Breach: Detect, Prevent, and Remediate the Dark Halo Supply Chain Attack
  2. Dark Halo Leverages SolarWinds Compromise to Breach Organizations
  3. OceanLotus: Extending Cyber Espionage Operations Through Fake Websites
  4. Evil Eye Threat Actor Resurfaces with iOS Exploit and Updated Implant
  5. Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign
  6. Microsoft Exchange Control Panel (ECP) Vulnerability CVE-2020-0688 Exploited

2019 3

  1. Vulnerable Private Networks: Corporate VPNs Exploited in the Wild
  2. Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs
  3. Sophisticated Phishing Campaign Targets Corporate Credentials

2018 7

  1. Active Exploitation of Newly Patched ColdFusion Vulnerability (CVE-2018-15961)
  2. Magecart Strikes Again: Newegg in the Crosshairs
  3. Active Exploitation of New Apache Struts Vulnerability CVE-2018-11776 Deploys Cryptocurrency Miner
  4. JS Sniffer: E-commerce Data Theft Made Easy
  5. Surge Collect Provides Reliable Memory Acquisition Across Windows, Linux, and macOS
  6. Patchwork APT Group Targets US Think Tanks
  7. Drupalgeddon 2: Profiting from Mass Exploitation

2017 3

  1. OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society
  2. Real News, Fake Flash: Mac OS X Users Targeted
  3. Have you been haunted by the Gh0st RAT today?

2016 1

  1. PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs

2015 4

  1. Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence
  2. APT Group Wekby Leveraging Adobe Flash Exploit (CVE-2015-5119)
  3. Afghan Government Compromise: Browser Beware
  4. A New Shellshock Worm on the Loose

2014 3

  1. Drupal Vulnerability: Mass Scans & Targeted Exploitation
  2. Democracy in Hong Kong Under Attack
  3. CVE-2014-6271 – Remotely Exploitable Vulnerability in Bash