Michael Ligh (MHL)
@iMHLv2
Followers
10K
Following
503
Media
100
Statuses
4K
CTO @Volexity. Malware Analyst's Cookbook. Art of Memory Forensics. The @Volatility Project. Thoughts are those of my employer, not mine, they made me say it.
Joined March 2011
Read @Volexity’s latest #threatintel blog post about Russian threat actor UTA0355's recent campaigns that abuse Device Code and OAuth authentication workflows to impersonate European security events: https://t.co/cJbA6HaxI1. [2/2]
volexity.com
In early 2025, Volexity published two blog posts detailing a new trend among Russian threat actors targeting organizations through the abuse of Microsoft 365 OAuth and Device Code authentication...
0
2
8
.@Volexity #threatintel tracks a wide variety of threat actors abusing Device Code & OAuth authentication workflows to phish credentials. And these techniques continue to see success due to creative social engineering. [1/2]
1
10
17
Check out our blog post for more details on how UTA0388 used AI + LLMs in their operations:
volexity.com
Starting in June 2025, Volexity detected a series of spear phishing campaigns targeting several customers and their users in North America, Asia, and Europe. The initially observed campaigns were...
0
1
6
@Volexity has continued to see nation-state threat actors use AI + LLMs to assist in cyber attacks. Our recent research on a Chinese APT threat actor (UTA0388) using AI in its operation was something @stevenadair recently discussed with the @WSJ.
Exclusive: China’s state-sponsored hackers used Anthropic’s AI model to automate break-ins of major corporations and foreign governments
1
3
12
It was great talking to @bobmcmillan earlier this week on nation-state threat actors using AI ahead of a report released by @AnthropicAI. We often suspect the use of AI in attacks, and our research confirmed #UTA0388 used it to identify targets, write emails, and dev malware.
@Volexity has continued to see nation-state threat actors use AI + LLMs to assist in cyber attacks. Our recent research on a Chinese APT threat actor (UTA0388) using AI in its operation was something @stevenadair recently discussed with the @WSJ.
0
3
5
The 13th annual @volatility #PluginContest is OPEN for submissions! This contest is designed to encourage research & development in the field of #memoryanalysis. Every year, contributions from all around the world continue to help build the next generation of #memoryforensics.
1
4
9
Make sure to get your submissions in by 31 December 2025. More details can be found here:
volatilityfoundation.org
We are excited to announce that the Volatility Plugin Contest is officially open for submissions! The annual Plugin Contest is your opportunity to: Directly contribute to the open source forensics …
0
5
3
We had a great day yesterday at #FTSCon 2025! FTSCon Week continues with @joegrand’s Hardware Hacking Basics + @volatility Malware & Memory Forensics training with @attrc, @iMHLv2 & @superponible.
0
5
10
And now @attrc is discussing Detection and Analysis of Linux Rootkits Using Memory Forensics at #FTSCon
@Volexity @volatility
5
4
17
Detecting and Preventing Obfuscated Script Execution with Tree-sitter, presented by David McDonald, Software Engineer at Volexity. This talk shows how tree-sitter can detect and block obfuscated scripts, strengthening defenses against AMSI bypasses and malware attacks. #BSidesNYC
0
4
17
Read @volexity’s latest blog post, "APT Meets GPT: Targeted Operations with UnTamed LLMs": https://t.co/g2QJV6SE47 [2/2]
volexity.com
Starting in June 2025, Volexity detected a series of spear phishing campaigns targeting several customers and their users in North America, Asia, and Europe. The initially observed campaigns were...
0
6
11
APT meets GPT: @Volexity #threatintel is tracking #UTA0388's spear phishing campaigns against targets in North America, Europe & Asia, that appear to use LLMs to assist the #threatactor’s ops. Letting #AI run your espionage operations? What could go wrong? [1/2]
1
24
69
We would like to thank @volexity for sponsoring the #FTSCon 2025 Evening Reception, which will be at VUE Rooftop DC this year! If you haven’t registered for FTSCon yet, there’s still time! Registration closes Sunday Oct 12; learn more + register here: https://t.co/NZA6bSWN8i
0
2
5
If you plan to attend the #FTSCon 2025 conference or training sessions, make sure to register before seats sell out! Registration closes this Sunday, October 12!
Coming up the week of October 20th: #FTSCon + TWO in-person #training opportunities! #dfir #memoryforensics #hardwarehacking
0
4
8
With Volcano, security teams can automate the entire workflow of acquisition of memory and select files to deep analysis to automated alerts that directly point to signs of memory only malware and attacker activity throughout RAM and key artifacts sources from disk.
.@Volexity Volcano Server & Volcano One v25.09.21 adds memory analysis support for ARM64 Linux, macOS 26 (Tahoe) & Windows 25H2, as well as 75+ new YARA rules, 10+ new IOCs, analysis of udev rules, and rolling upgrades for managed endpoints. [1/2]
0
5
8
Contact us for more information about @Volexity Volcano Server & Volcano One: https://t.co/KPNOCyK70C [2/2]
volexity.com
If you'd like to learn more about Volexity, please contact us!
0
1
2
Coming up the week of October 20th: #FTSCon + TWO in-person #training opportunities! #dfir #memoryforensics #hardwarehacking
Coming this October: #FTSCon 2025, hosted by @volatility! And this year there are TWO in-person training opportunities!👇 #dfir #memoryforensics #volatility3 #hardwarehackingbasics #grandideastudio
1
4
11