Volexity
US incident-response and threat-intelligence firm.
On 13 October, Volexity disclosed a three-flaw Ivanti intrusion that lived only in memory, evaded the vendor's checker and stole persistent credentials.
Last refreshed: 22 October 2026 · Appears in 1 active topic
Can memory forensics expose attackers that leave no files behind?
Timeline for Volexity
Found UTA0576 exploiting the Connect Secure chain
Cybersecurity: Threats and Defences: UTA0576 hit Ivanti VPNs before a fixBackground
Volexity is a United States incident-response and threat-intelligence firm. It investigates compromises, reconstructs attacker behaviour and uses memory evidence when an intrusion leaves little or nothing on disk.
Its October 2026 Ivanti investigation found three vulnerabilities chained against Connect Secure appliances. The unknown actor, labelled UTA0576, worked only in volatile memory and was invisible to Ivanti's checker. Volexity identified stolen directory and administrator credentials rather than a persistent backdoor.
That finding matters to The Firm's role in Incident Response. A patched appliance can still leave an organisation exposed when an attacker copied passwords before the upgrade. Volexity's evidence therefore connected technical exploitation with the recovery work needed after the software itself changes.
Volexity finds an in-memory Ivanti intrusion
Volexity found an unknown actor, which it labelled UTA0576, exploiting three chained flaws in Ivanti Connect Secure from 3 October. Ivanti disclosed the first flaw on 13 October, while the final link in the chain still had no patch at the time of reporting.
The intruder operated only in memory, so Ivanti's checker found nothing. It took directory and administrator passwords, which remain valid after an appliance upgrade until defenders change them. For Volexity, the case showed the value of memory forensics when an attacker avoids files and leaves credential theft as the lasting risk.
What is Volexity?
What did Volexity find in Ivanti Connect Secure?
Why did Ivanti's Integrity Checker miss UTA0576?
What does Volexity think motivates UTA0576?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.