5ck

Targeted threat analysis, Incident Response, Malware Analysis and Forensics (memory/disk/network). Co-Founder @Volexity

[L0Psec @L0Psec]

Quick update. I am now with @Volexity :) super excited! Last few months were not the easiest but thankfully I have great friends in the field and was able to stay afloat and find the right place.
I got lucky in this current job market. Back to reversing malware and drifting :)

[5ck @5ck]

@budget your FLL location is out of cars, even for customers that have existing reservations. People waiting for hours for cars to be returned. This is unacceptable!

[Volexity @Volexity]

.@Volexity #threatintel tracks a wide variety of threat actors abusing Device Code & OAuth authentication workflows to phish credentials. And these techniques continue to see success due to creative social engineering. [1/2]

[#BSidesNYC @BSidesNYC]

Detecting and Preventing Obfuscated Script Execution with Tree-sitter, presented by David McDonald, Software Engineer at Volexity.
This talk shows how tree-sitter can detect and block obfuscated scripts, strengthening defenses against AMSI bypasses and malware attacks. #BSidesNYC

[Volexity @Volexity]

APT meets GPT: @Volexity #threatintel is tracking #UTA0388's spear phishing campaigns against targets in North America, Europe & Asia, that appear to use LLMs to assist the #threatactor’s ops. Letting #AI run your espionage operations? What could go wrong? [1/2]

[volatility @volatility]

#FTSCon Speaker Spotlight: Andrew Case (@attrc) is presenting “Detection and Analysis of Memory-Only Linux Rootkits” in the MAKER track.

See the full list of speakers + event info, including how to register, here: https://t.co/NZA6bSWN8i

[5ck @5ck]

#FTSCon 2025 is just a little over a month away. There are some really amazing talks lined up this year.

Don't miss out on one of the best events focused on #DFIR. Hear from researchers that build tools and analysts that work on some of the most advanced IR investigations!

[volatility @volatility]

We are counting down to #FTSCon 2025! We have a slate of great speakers — you don't want to miss this event! If you haven't registered yet, register here: https://t.co/6mD0PoxraS.

See the event page for details: https://t.co/NZA6bSWN8i

Stay tuned for speaker spotlights!

[volatility @volatility]

@joegrand This training is hosted by @Volatility in conjunction with From The Source (#FTSCon). Course registration includes a complimentary ticket to FTSCon on Monday, Oct 20, 2025. For more details about FTSCon, visit the event page: https://t.co/NZA6bSWN8i.

[tlansec @tlansec]

@Volexity is looking to grow our Threat Intelligence team. New job posting for Senior Analyst role is up here: https://t.co/e1bsbMkV1L... If you have any questions, don't hesitate to ask.

[5ck @5ck]

Nice work, lots of good info in this blog by @_xDeJesus!

[Terrance DeJesus @_xDeJesus]

Did a write-up on OAuth phishing (offense and defense). It's based on phishing campaign's reported by @Volexity earlier this year.

- What are OAuth phishing links; what is the workflows behind them
- How to emulate (examples) and use ROADtools for further compromise
- Approaches to writing detections and key telemetry

I do believe we are likely to see more of these campaigns over time - I hope this blog serves y'all well.

Happy hunting folks! #azure #cloudsecurity #phishing

https://t.co/EmLdJQyQxD

[volatility @volatility]

We are excited to announce FTSCon 2025 on October 20, 2025, in Arlington VA! Registration is now OPEN + we have a Call for Speakers.

Following FTSCon will be a 4-day Malware & Memory Forensics Training course with Volatility 3.

See the full details here: https://t.co/ygqxNhZyW2

[5ck @5ck]

New research from the team: Involves clever m365 OAuth tricks + phishing via Signal and WhatsApp to compromise accounts. #dfir #threatintel

[Volexity @Volexity]

.@Volexity #threatintel: Multiple Russian threat actors are using Signal, WhatsApp & a compromised Ukrainian gov email address to impersonate EU officials. These phishing attacks abuse 1st-party Microsoft Entra apps + OAuth to compromise targets.

https://t.co/31cinaoDfB

#dfir

[Volexity @Volexity]

.@Volexity #threatintel: Multiple Russian threat actors are using Signal, WhatsApp & a compromised Ukrainian gov email address to impersonate EU officials. These phishing attacks abuse 1st-party Microsoft Entra apps + OAuth to compromise targets.

https://t.co/31cinaoDfB

#dfir

[Volexity @Volexity]

Today, @Volexity released GoResolver, open-source tooling to assist reverse engineers with obfuscated Golang samples. @r00tbsd & Killian Raimbaud presented details at INCYBER Forum earlier today. Learn how GoResolver works + where to download it: https://t.co/dZ4hNUBK1I
#dfir

[Volexity @Volexity]

.@Volexity regularly assists customers in combatting advanced threat actors & we enjoy being able to assist our partners as well, including LE & federal agencies like US DOJ, as we work together to combat these advanced cyber threats.

https://t.co/v52zQhwqKk

#dfir #threatintel

[5ck @5ck]

One of the main takeaways -- block device code authentication flow via conditional access 2/2
#Microsoft365 #DFIR #ThreatIntel

[5ck @5ck]

Check out the new blog: Russian APT adopts a well-known technique of m365 device code phishing. When combined with clever lures this technique proved to be extremely successful. 1/2

[Volexity @Volexity]

.@Volexity recently identified multiple Russian threat actors targeting users via #socialengineering + #spearphishing campaigns with Microsoft 365 Device Code authentication (a well-known technique) with alarming success: https://t.co/LLXhY0FJRi

#dfir #threatintel #m365security

[Volexity @Volexity]

It’s great to see @NCSC drawing attention to the ongoing issues with network devices & appliances. Hopefully, vendors will heed the volatile data collection guidance: “Volatile data logging should support collection of… memory both at a kernel and individual process level.”
1/2

[Volexity @Volexity]

On Thursday, Feb 6, @attrc will be at @WWHackinFest to present "Effectively Detecting Modern Code Injection Techniques with Volatility 3". See the full conference agenda here: https://t.co/FrZqNbsUsk.

#dfir #memoryforensics #Volatility3 @volatility

[Ryan Naraine @ryanaraine]

Catch the #ThreeBuddyProblem segment on Bootkitty being a Korean university project, LogoFAIL firmware exploits, inspectability below the OS...

(with @juanandres_gs @craiu @stevenadair)