#memoryforensics

@volexity@infosec.exchange is hiring!   Join a team that develops concrete solutions to the most challenging real-world problems. Whether your focus is bringing new products to market or delivering cybersecurity services to customers worldwide, the work you do here helps real people and moves the industry forward.   See how you can plug in: https://www.volexity.com/company/careers/   #dfir #hiring #memoryforensics #threatintel #cybersecurity

@volexity@infosec.exchange is heading to Las Vegas! Members of our leadership, development, engineering & threat intelligence teams will be on site August 4–6. If you would like to connect to discuss the latest in #DFIR, #memoryforensics, or the current threat landscape, let us know when you’d like to meet: https://www.volexity.com/contact/meet-up-in-vegas/

@volexity@infosec.exchange has published details on a recent incident response investigation involving the exploitation of multiple #0day vulnerabilities in SonicWall SMA 1000 series appliances. Volexity attributes this activity to a threat actor it tracks as UTA0533, with the earliest signs of compromise dating back to June 22, 2026. SonicWall has released patches (versions 12.4.3-03453 and 12.5.0-02835) following their July 14 public disclosure. Organizations using affected SMA 1000 series devices should upgrade immediately. Read our full technical breakdown, including the vulnerability workflow, malware analysis, and IOCs: https://www.volexity.com/blog/2026/07/17/proxying-to-compromise-sonicwall-secure-mobile-access-0-day-exploitation/ #dfir #memoryforensics #threatintel

---------------- 🛠️ Tool =================== Orochi is an open-source framework for collaborative forensic memory dump analysis, developed by LDO-CERT and built on Volatility 3, Django, and Dask. Key Features The core value proposition is multi-analyst collaboration on memory forensics. Multiple analysts can upload, analyze, and correlate memory dumps simultaneously through a web interface, eliminating the need for local Volatility installations or manual result sharing. The architecture distributes Volatility 3 plugin execution across Dask workers, enabling parallel processing of forensic artifacts. The stack includes: • Volatility 3: Core memory forensics framework for extracting digital artifacts • Dask: Parallel computing library distributing plugin execution across workers • PostgreSQL: Stores user and analysis metadata • Redis: Message broker and cache for asynchronous communications between components • Django WSGI/ASGI: Web backend with real-time WebSocket updates for result delivery • Nginx: Reverse proxy providing HTTPS termination • Mailpit: Local SMTP service for user registration emails • Docker Compose: Orchestrates the full stack for x64 and arm64 platforms The real-time WebSocket updates via Django ASGI mean analysts see results as they complete rather than polling or refreshing. Technical Implementation When an analyst triggers a Volatility plugin against a memory dump, the task is queued through Redis and distributed to available Dask workers. Results are persisted to PostgreSQL and pushed to connected clients via WebSocket. Symbol files and Volatility plugins are managed through the admin interface or management commands. Use Cases • Incident response teams correlating memory analysis across multiple compromised endpoints • SOC workflows where analysts share findings without transferring large dump files • Multi-host forensic correlation to identify common artifacts across breached machines • Training environments for memory forensics education with shared datasets Considerations The tool requires Docker infrastructure and sufficient storage for potentially large memory dump files. The Dask architecture allows scaling workers based on analysis demand, but resource planning is needed for production deployments. Default credentials (admin/admin) should be changed before any non-lab deployment. The initial setup requires downloading Volatility plugins and symbol files. Note: haven't tested personally. 🔹 orochi #memoryforensics #volatility3 #dfir #tool 🔗 Source: https://github.com/LDO-CERT/orochi