Andrew Case

@Volatility | @Volexity | @lsucyber | The Art Of Memory Forensics | DFIR and AI

[Andrew Case @attrc]

Volcano now speaks MCP. One prompt to hunt for rootkits, memory-only malware, and active exploitation across every Windows, Linux, and macOS system in your enterprise.

[Volexity @Volexity]

.@Volexity has published the third and final installment of its Mind the (Patch) Gap series. Parts 1 and 2 detailed Volexity’s discovery of multiple Chinese threat actors chaining zero-day exploits in Google Chrome and Microsoft Windows to deploy malware. This post takes a closer look at Volexity Volcano, one of the most advanced tools behind those findings.

The blog post also showcases Volcano’s new MCP server for AI-assisted incident response, threat hunting, and digital forensics. Volexity analysts used it to triage a compromised system, automatically annotate related artifacts, create new IOCs for future detection, and schedule targeted collections across endpoints.

Read the full post here: https://t.co/6r1aoyCUq9

#dfir #threatintel #memoryanalysis #memoryforensics

[Andrew Case @attrc]

@adamscochran Don't spread FUD: https://t.co/1W4EcEcM3d

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

@MiaAI_lab Don't spread FUD:

https://t.co/1W4EcEdjSL

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

@BenBajarin Don't spread FUD: https://t.co/1W4EcEcM3d

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

@MTSlive The @cohere story is FUD: https://t.co/1W4EcEdjSL

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

@beffjezos The cohere post is nonsense FUD:
https://t.co/KZ6Ym4pBMR

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

@aidangomez Your post is nonsense FUD:

https://t.co/1W4EcEcM3d

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

@AndrewCurran_ The post from cohere is nonsense FUD:

https://t.co/1W4EcEcM3d

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

@imaurer @InnovativeCoder @cohere The post is nonsense FUD: https://t.co/1W4EcEcM3d

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Andrew Case @attrc]

This reads as 1000% FUD. @cohere told the LLM to create a detection for:

"""... malicious file download and execution by monitoring for curl processes downloading bash scripts to /tmp followed by bash execution"""

And then the LLM ran a curl invocation that sent a harmless static string over curl and downloaded the payload to /tmp.. so the LLM did exactly what it was instructed. Shocking!!!

[Cohere @cohere]

While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.

Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.

Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.

But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?

We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.

Read the full report: https://t.co/TZSugXi2ZE

[Andrew Case @attrc]

I had a great time speaking at @BSidesNYC and @BSidesAugusta over the last two weekends. I highly recommended both events for those looking to present research or to hear great talks from others!

[Andrew Case @attrc]

@InfoSec208 Thank you for attending!

[Andrew Case @attrc]

@toddatlarge Thank you!

[Andrew Case @attrc]

@lizzadwoskin Taking 12 hours when you are powered by AI agents indicates a serious skill issue. Divide by 10 for experienced attackers.

[Andrew Case @attrc]

Taking 12 hours when you are powered by AI agents indicates a serious skill issue. Divide by 10 for experienced attackers.

[Elizabeth Dwoskin @lizzadwoskin]

EXCLUSIVE: In less than 12 hours, a group of ex-DOGE cyber researchers were able to penetrate Anthropic’s systems using AI agents — including Slack channels where the most sensitive models are discussed.
This is just weeks after
Anthropic whistleblower Joseph Coxon charged the company w/launching “a hubristic gamble” from a “private company’s Slack.”
Read our story here (gift link):
https://t.co/x6F8Dg6SLR

[Andrew Case @attrc]

The most valuable goals are to 1) make your internet facing router an enterprise tier device or a multi NIC Linux system 2) separated WiFi with the router disallowing traffic between WiFi networks. For the strongest end goal, you really want 3 splits. One for IOT/home devices, one for personal/family members' laptops/phones/etc. One for work devices

[Andrew Case @attrc]

@cocktailpeanut Definitely. It is a wise move now to make friends with people in cybersecurity, if you don't have them already. The amount of FUD will remain high for quite a long time.

[Andrew Case @attrc]

@joemccann @vercel Auto applying library patches and updates is how you get supply chain attacks within your environment. Three days is the minimum acceptable package age before pip/npm/<similar ecosystem> installs.

[Andrew Case @attrc]

First publicly confirmed exploitation of the PHP bugs??

[Adel Ka @0x4D31]

🧵👀 ahh shit, might’ve caught a potential RCE. investigating…