Loading story…
Volexity published a new entry on its Threat Intelligence & Memory Forensics blog at volexity.com, indicating a fresh security research release from the incident response and threat intelligence firm. The available reference identifies the post as part of Volexity’s blog stream but does not include a synopsis or technical summary of the underlying findings.
Because no article abstract, indicators, or vulnerability details were provided in the reference, the specific threat, malware family, intrusion activity, or defensive guidance discussed in the post could not be independently confirmed from the source data alone. Organizations tracking Volexity research may want to review the original publication directly for any actionable intelligence, forensic artifacts, or detection recommendations.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
A Volexity blog entry at http://www.volexity.com/blog/?p=158 was published, indicating a threat intelligence or memory forensics-related disclosure. No synopsis or additional incident details are available in the reference provided.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trellix disclosed that attackers gained unauthorized access to part of its internal source code repository and said it immediately engaged external forensic experts and notified law enforcement. The cybersecurity vendor reported that its investigation had found **no evidence** that the release or distribution pipeline was compromised, that customer-facing products were tampered with, or that the accessed code had been exploited in the wild, but the inquiry remains ongoing. The incident is significant because Trellix is a major endpoint security and XDR provider formed from the merger of McAfee Enterprise and FireEye, with products used by governments and large enterprises. Public reporting said key details remain unclear, including the intruder's identity, the initial access vector, dwell time, which products or codebases were affected, and whether any additional data was exfiltrated; security observers warned that exposed source code can aid vulnerability discovery, reveal defensive logic, and create potential downstream supply-chain risk even without confirmed product compromise.
Jun 29, 2026
A weekly threat-intelligence roundup highlighted **Microsoft’s January Patch Tuesday** release addressing **112 vulnerabilities** across Windows and *Microsoft Edge*, spanning multiple classes including elevation of privilege, remote code execution, and information disclosure. The same briefing reported active interest in **CVE-2025-64155**, a **critical FortiSIEM** vulnerability, with observed exploitation activity against honeypot environments following an out-of-band alert from Kroll Threat Intelligence—an indicator of likely broader scanning and attempted exploitation. The update also covered multiple threat developments: Check Point research described **VOIDLINK**, a Linux-focused malware framework (implants/rootkits/loaders) designed for long-term access, including in cloud environments; **North Korean-linked KTA082 (Kimsuky/APT43)** was reported using **QR-code phishing (“quishing”)** to target government, education, and think tanks; and **Iran-linked KTA060 (MuddyWater)** was associated with development of the **RUSTYWATER RAT**. Separately, detection-engineering updates noted new and refined rules for **OAuth/Entra ID consent phishing** patterns (including *ConsentFix*-style authorization flows), correlations between Entra ID risk events and privileged actions (e.g., PIM elevation/device-code auth), Windows persistence/defense-evasion behaviors (e.g., scheduled tasks by unsigned executables, Chrome security feature tampering), and updated YARA/behavioral detections for malware families (e.g., **Agent Tesla**, **MintsLoader**) and **Cobalt Strike** TTPs; the briefing also referenced a leak of a database purportedly containing ~**324,000 BreachForums** user records posted to `shinyhunte[.]rs`.
Jun 29, 2026
SentinelOne reported that reexamining older cyber intrusions with modern tooling is yielding new intelligence that can improve present-day defense. The research says retrospective analysis can expand indicators of compromise, reveal broader victimology, strengthen attribution, and surface infrastructure or malware relationships that were missed during the original investigations. Examples cited include new insights into the **Sandman** cluster, **ModifiedElephant** activity targeting individuals in India, Chinese-attributed operations in Africa linked to **Backdoor Diplomacy** and **BRONZE STARLIGHT**, and the **Appin** hack-for-hire operation in India. SentinelOne said improved **YARA** techniques and access to large malware repositories such as **Stairwell** and **VirusTotal** are helping analysts extract fresh findings from historical datasets, malware samples, and legacy infrastructure.
Jun 29, 2026