Volexity details Volcano MCP server and threat intel for triaging UTA0560 Chrome and Windows zero-day exploit chain
Volexity published Part 3 of its "Mind the (Patch) Gap" series. It shows how Volexity Volcano and Surge Collect Pro were used to analyze a VM compromised with the zero-day exploit chain and payloads used by UTA0560 (Chrome and Windows zero-days, described in Part 1). The post is mainly product and workflow documentation rather than new incident reporting. It covers the new MCP (Model Context Protocol) server, which lets AI clients such as OpenAI's Codex triage memory evidence, annotate artifacts, create IOCs and schedule endpoint collections. Volexity says Volcano's built-in IOCs flagged the memory-only components, and that GRIMWEDGE-encoded JavaScript was recovered from free memory (slack space).
Technical Details
- Surge Collect Pro captured RAM, registry hives, event logs, $UsnJournal, $MFT and other artifacts, which Volcano then processed.
- Built-in IOCs detected reflectively loaded DLLs and position-independent shellcode in chrome.exe, plus the persistence mechanism, privilege anomalies and invalid parent/child process relationships.
- The Volexity Threat Intel indicator matched the hostname cloud.shinewrist[.]net in event logs and in the command lines of command shells and curl processes.
- Via MCP, the AI agent auto-applied labels (codex-*) to artifacts related to UTA0560 and GRIMWEDGE and created query-, string- and YARA-based IOCs for UTA0560, GRIMWEDGE and JungleBamboo, using Volexity's published indicators on GitHub.
- Re-running the IOCs surfaced GRIMWEDGE-encoded JavaScript in free memory, which EDR and antivirus typically cannot inspect.
- Volcano Endpoint demonstration: an agentic workflow scheduled a light registry and browser-history collection, then automatically escalated to a memory plus DFIR-files collection when a codex-* IOC fired. The trigger was a test URL seeded in Microsoft Edge.
Remediation
- Collect and analyze memory in addition to disk, because components of this chain exist only in memory.
- Subscribe to threat intelligence feeds and apply Volexity's published indicators (github.com/volexity/threat-intel, 2026-09-09 Chrome) to hunt for the same infrastructure and artifacts across hosts.
- Use host-based IOC scanning and network security monitoring to scope other affected systems.
Linha do tempo
-
Volexity details Volcano MCP server and threat intel for triaging UTA0560 Chrome and Windows zero-day exploit chain
ler a análise desta fonte ocultar
Volexity published Part 3 of its "Mind the (Patch) Gap" series. It shows how Volexity Volcano and Surge Collect Pro were used to analyze a VM compromised with the zero-day exploit chain and payloads used by UTA0560 (Chrome and Windows zero-days, described in Part 1). The post is mainly product and workflow documentation rather than new incident reporting. It covers the new MCP (Model Context Protocol) server, which lets AI clients such as OpenAI's Codex triage memory evidence, annotate artifacts, create IOCs and schedule endpoint collections. Volexity says Volcano's built-in IOCs flagged the memory-only components, and that GRIMWEDGE-encoded JavaScript was recovered from free memory (slack space).
Technical Details
- Surge Collect Pro captured RAM, registry hives, event logs, $UsnJournal, $MFT and other artifacts, which Volcano then processed.
- Built-in IOCs detected reflectively loaded DLLs and position-independent shellcode in chrome.exe, plus the persistence mechanism, privilege anomalies and invalid parent/child process relationships.
- The Volexity Threat Intel indicator matched the hostname cloud.shinewrist[.]net in event logs and in the command lines of command shells and curl processes.
- Via MCP, the AI agent auto-applied labels (codex-*) to artifacts related to UTA0560 and GRIMWEDGE and created query-, string- and YARA-based IOCs for UTA0560, GRIMWEDGE and JungleBamboo, using Volexity's published indicators on GitHub.
- Re-running the IOCs surfaced GRIMWEDGE-encoded JavaScript in free memory, which EDR and antivirus typically cannot inspect.
- Volcano Endpoint demonstration: an agentic workflow scheduled a light registry and browser-history collection, then automatically escalated to a memory plus DFIR-files collection when a codex-* IOC fired. The trigger was a test URL seeded in Microsoft Edge.
Remediation
- Collect and analyze memory in addition to disk, because components of this chain exist only in memory.
- Subscribe to threat intelligence feeds and apply Volexity's published indicators (github.com/volexity/threat-intel, 2026-09-09 Chrome) to hunt for the same infrastructure and artifacts across hosts.
- Use host-based IOC scanning and network security monitoring to scope other affected systems.