Volexity Details AI-Enhanced Incident Response with Volcano Platform
Volexity's latest blog post showcases its Volcano platform, enhanced with AI and threat intelligence, for rapid analysis of zero-day exploits used by Chinese threat actors.
Volexity has published the third installment of its "Mind the (Patch) Gap" series, delving into the technical capabilities of its Volexity Volcano platform. This advanced tool was instrumental in analyzing recent zero-day exploits targeting Google Chrome and Microsoft Windows, which were simultaneously deployed by multiple Chinese threat actors. The series previously detailed the exploits and malware observed, along with general detection methods, but this post focuses on the platform that enabled these discoveries.
Volexity Volcano is designed for enterprise-scale rapid response and advanced detection across Windows, Linux, and macOS endpoints. Recent enhancements include integration with Volexity's Cyber Threat Intelligence feed for high-fidelity indicators of compromise (IOCs) and the introduction of a Model Context Protocol (MCP) server. This MCP server leverages AI to significantly expedite incident response, threat hunting, and digital forensics, building upon Volcano's existing capabilities in memory, file, and registry analysis.
To demonstrate its effectiveness, Volexity researchers simulated a compromise on a virtual machine using the same zero-day exploit chain and payloads attributed to UTA0560. Even after the simulated attackers attempted to cover their tracks, Volcano's counterpart, Surge Collect Pro, was used to acquire critical forensic artifacts. This included memory dumps, registry hives, event logs, and file system metadata, which were then processed by Volcano to reconstruct the attacker's activity and analyze related evidence.
The platform's built-in IOCs proved adept at identifying memory-only components, such as reflectively loaded DLLs and shellcode within Chrome processes, as well as persistence mechanisms and anomalous process relationships. Furthermore, Volcano's integration with Volexity Threat Intel feeds provides real-time lookups against malicious IP addresses, DNS names, and YARA rules, offering subscribers advanced warning of attacker infrastructure and comprehensive alerting across all collected data.
Volcano's MCP server represents a significant leap in AI-assisted incident response. By connecting to models like OpenAI's GPT-6.1-Sol, analysts can perform complex triage tasks with natural language prompts. For instance, an analyst could ask Volcano to analyze a specific Chrome exploit sample, determine if certain IOCs relate to a zero-day, and even disassemble shellcode, tasks that historically required extensive manual effort from seasoned forensic experts.
Beyond initial triage, the MCP server facilitates deeper analysis and automated annotation. Analysts can prompt the AI to identify artifacts related to specific threat actors or campaigns, automatically labeling them with contextual notes. This capability streamlines collaboration and allows for more efficient grouping and pivoting on alerts within the Volcano interface, concentrating crucial information about the compromised system's state.
While Volcano excels at deep-dive analysis of individual systems, its breadth extends to identifying the scope of an incident. By leveraging its comprehensive access to physical memory and integrating with Volexity's Network Security Monitoring, the platform aids in answering critical questions about how widespread an attack is and what other systems may be affected. This holistic approach ensures that investigations are both thorough and far-reaching.