Andrew Case

@Volatility Core developer, Dir. of Research @Volexity, @lsucyber, The Art Of Memory Forensics Co-Author

[Andrew Case @attrc]

With Volcano, security teams can automate the entire workflow of acquisition of memory and select files to deep analysis to automated alerts that directly point to signs of memory only malware and attacker activity throughout RAM and key artifacts sources from disk.

[Volexity @Volexity]

.@Volexity Volcano Server & Volcano One v25.09.21 adds memory analysis support for ARM64 Linux, macOS 26 (Tahoe) & Windows 25H2, as well as 75+ new YARA rules, 10+ new IOCs, analysis of udev rules, and rolling upgrades for managed endpoints. [1/2]

[Andrew Case @attrc]

Your on-the-go life really changes when you get a powerful desktop (Mac Studio) at home and @Tailscale back for long running tasks

[Brad Spengler @spendergrsec]

https://t.co/M8IXdJamtN

[Andrew Case @attrc]

I watched this keynote live last week and it was incredible! I highly recommend @aaronportnoy if your conference is looking for a keynote that is truly relevant to today's threat landscape.

[cje @caseyjohnellis]

ok, so this talk from @aaronportnoy from @ekoparty is absolutely phenomenal... my neck hurts from nodding

my tldr takeaway: defenders need to start listening *really carefully* to actual, economically rational attackers

the cadence of the OODA loop that we've grown used to over the years is now *way* too tight

https://t.co/KKzjifhQkS

[Andrew Case @attrc]

MSRC woke up and decided to kill off all the good will it has built up over the last decade:

https://t.co/EqmlcWqYfU

[Dave Aitel @daveaitel]

This looks like a really good conference

[Andrew Case @attrc]

Does anyone know the actual effect of what Riot did? Are the cards actually bricked? OS updated required? Reinstall? The existing replies all seem to be from bots and are entirely useless.

[Riot Games @riotgames]

congrats to the owners of a brand new $6k paperweight

[Volexity @Volexity]

The latest @DarknetDiaries (Ep. 174: Pacific Rim) offers a look at state-sponsored groups targeting perimeter infrastructure & edge devices. Thanks @JackRhysider for mentioning our work!

@Volexity’s detection and response efforts combined network visibility, host-based analysis, #threatintelligence & #memoryforensics, enabling us to discover these complex #0days being exploited in the wild.

Read our blog post for the original research mentioned: https://t.co/CD8eiXiriT

[Andrew Case @attrc]

@TheStalwart You should reach out to @daveaitel @dinodaizovi @halvarflake for meaningful thoughts on this

[Brendan Dolan-Gavitt @moyix]

I'm glad we can finally talk about this! :D As an inveterate blabbermouth it has been killing me to keep my blabbering mouth shut

[Andrew Case @attrc]

With Volcano, security teams can automate the entire workflow of acquisition of memory and select files to deep analysis to automated alerts that directly point to signs of memory only malware and attacker activity throughout RAM and key artifacts sources from disk.

[Michael (Allegedly) @MichaelAlleged]

so you’re telling me fighters in the desert need to move in strange ways to avoid the ire of an inescapable predator?

[BSides Memphis @BSidesMemphiss]

SAVE THE DATE!!

BSides Memphis will be hosted at Epicenter Memphis on October 3rd, 2026!

More info to come on tickets, CFP, Sponsors, ect.

please share so the local community knows this is happening!

[Andrew Case @attrc]

Your on-the-go life really changes when you get a powerful desktop (Mac Studio) at home and @Tailscale back for long running tasks

[resham ☻ @Reshusaur]

new walk of shame:
agent still working, but the cafe closed

[REcon @reconmtl]

We have started announcing Recon 2026 Presentations https://t.co/HwPY5z16lV
More talks to be announced soon once we have confirmations @frodosobon @realytcracker @allthingsida @hexnomad @0x464D @hunterbr72 @joegrand @clearbluejar @InvokeReversing @LennertWo @pinkflawd @Coiffeur0x90 @MathildeVenault @NicoleFishi19 @nicolodev @phLaul @SinSinology @i0n1c @mr_phrazer @tmanning @hex86_64
#REcon2026 #ReverseEngineering #InfoSec #cybersecurity

[Andrew Case @attrc]

I am excited to announce that I will be speaking at @bsidesnash on May 15th. Be sure to attend to see all the latest @volatility 3 plugins against the most sophisticated and devastating malware from the wild!

[L0Psec @L0Psec]

Another interesting one shared by @malwrhunterteam:
1c715cd40331ba2ca6559d2fdb958e7f44053080f9ffd3d90bd1916978d336cb ( 1 VT hit for DPRK). This is a fun one and even has a usage prompt when executing, which is strange.
🧵 Let's dig in

[BSidesCharm @BSidesCharm]

If you haven't grabbed a ticket for #BSidesCharm 2026, WHY NOT??? - go to https://t.co/ncEyYLMTxi - 1 ticket gets you in for BOTH days!

[Andrew Case @attrc]

I am excited to announce that I will be speaking at @bsidesnash on May 15th. Be sure to attend to see all the latest @volatility 3 plugins against the most sophisticated and devastating malware from the wild!

[Andrew Case @attrc]

Can't agree more. The depth of these reports is incredible!

[Justin Elze @HackingLZ]

CISOs should consider taking 30 minutes and reading a few random reports from @TheDFIRReport

https://t.co/IsUG5tv2Q2

[Andrew Case @attrc]

Memory-only malware leaves no trace on the file system & is commonly used by threat actors ranging from criminal organizations to ransomware operators to APTs. In our @volatility 3 training, students gain deep hands on experience analyzing such threats:

https://t.co/kihCRhwaov