Volexity Demonstrates AI-Assisted Incident Triage and Forensics with Volcano MCP
Summary
Volexity demonstrates using Volcano’s MCP integration to analyze a VM infected with a UTA0560 exploit chain, annotate artifacts, create IOCs, and schedule endpoint collections for follow-up.
Key points
- Researchers recreated a UTA0560 Chrome and Windows zero-day exploit-chain infection in a virtual machine, then used Surge Collect Pro to capture memory, registry hives, event logs, and other forensic artifacts.
- Volcano’s built-in IOCs identified memory-only components, persistence, and process or privilege anomalies; threat-intelligence feeds also flagged malicious infrastructure.
- Using an MCP-connected AI client, analysts queried the sample, labeled artifacts associated with UTA0560 and GRIMWEDGE, and created additional IOCs for future evidence.
- The article reports finding GRIMWEDGE-encoded JavaScript and proof in free memory, which it says standard EDR and antivirus tools cannot access.
- Volcano Endpoint demonstrations used IOC-triggered results to schedule an expanded collection of browser files and memory from a Windows server.
Article Details
- Topic
- Using Volexity Volcano and its MCP server for AI-assisted incident response, forensic analysis, and threat detection
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | cloud[.]shinewrist[.]net | Malicious hostname identified by Volexity Threat Intel and detected in event logs and command-line activity. |
| URL | hxxps[:]//cloud[.]shinewrist[.]net/foo/Files1.html | Specific URL on the identified malicious hostname, seeded in a browser to trigger a Volcano IOC. |
Threat Actors
Vendors
Products
Google ChromeVolexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google Chrome and Microsoft Windows in campaigns that, if successful, would download and run malware on an exploitedMicrosoft EdgeThen, its Microsoft Edge browser was seeded with hxxps://cloud.shinewrist[.]net/foo/Files1.html to trigger one of the new IOCs.Microsoft Windowsof multiple Chinese threat actors simultaneously using zero-day exploits in Google Chrome and Microsoft Windows in campaigns that, if successful, would download and run malware on an exploited system.Volexity Surge Collect ProSurge Collect Pro AcquisitionVolexity VolcanoBehind those findings was one of the most advanced tools in Volexity’s arsenal: Volexity Volcano.