Volexity Details Analysis of Chinese Threat Actors Using Chrome and Windows Zero-Days

Volexity published the third installment of its Mind the (Patch) Gap series on October 16, 2026. The report details how researchers analyzed zero-day exploit chains used by Chinese threat actors against Google Chrome and Microsoft Windows systems.

The previous posts in the series described campaigns where attackers attempted to download and execute malware on compromised endpoints. Volexity stated that these efforts involved multiple Chinese threat actors operating simultaneously. The latest article focuses on the forensic tools and intelligence feeds used to reconstruct the attacks.

Forensic Analysis and Detection

Volexity researchers demonstrated their findings by compromising a virtual machine with the same exploit chain used by threat actor UTA0560. After the simulated attackers realized the environment was monitored, they attempted to clean up their tracks. Volexity then used Surge Collect Pro to capture system memory, registry hives, and event logs.

The data was processed by Volexity Volcano, which identified suspicious artifacts automatically. The tool detected memory-only components, including reflectively loaded dynamic link libraries and position-independent shellcode residing in chrome.exe. It also flagged anomalies related to system privileges and invalid parent-child process relationships.

Threat Intelligence Integration

Volcano integrates with Volexity’s Cyber Threat Intelligence feed to provide real-time lookups of malicious indicators. This feature complements built-in detections by checking against known malicious IP addresses, DNS names, and YARA rules. Subscribers receive advance notice of attacker infrastructure and thorough alerting across all evidence supplied to the platform.

In the analysis, the malicious hostname cloud.shinewrist[.]net was detected in event logs and command lines. The tool identified this domain in the command shells and curl processes used by the attackers. This integration allows for rapid correlation of forensic artifacts with known threat intelligence data.

AI-Assisted Incident Response

Volexity introduced a new Model Context Protocol (MCP) server to enhance AI-assisted investigations. This feature allows traditional forensic analysts and security operations center operators to use AI models for threat hunting and digital forensics. The company demonstrated this by using OpenAI’s Codex client with GPT-6.1-Sol to connect to Volcano’s MCP.

The MCP server aims to make memory forensics technology more accessible to information security personnel. Volexity noted that while other public and local models are viable, results may vary depending on the strength of the model. The automation helps expedite investigations by handling collection import and artifact extraction.

What should you do?

Organizations should monitor for unusual process relationships and privilege escalations that may indicate exploitation. Security teams should verify that their forensic tools can detect memory-only malware components, such as shellcode in browser processes. Analysts should correlate internal event logs with external threat intelligence feeds to identify known malicious domains.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: Volexity

• Review endpoint detection and response logs for reflectively loaded DLLs and shellcode in unexpected processes.
• Validate that security tools can detect anomalies in parent-child process relationships on Windows systems.
• Cross-reference internal DNS and HTTP traffic logs with current threat intelligence indicators for malicious hostnames.
• Ensure forensic acquisition tools can capture memory and registry artifacts before attackers can clean up their tracks.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which threat actor was involved in the zero-day campaigns described by Volexity?

Volexity identified Chinese threat actor UTA0560 as using the zero-day exploit chains in Google Chrome and Microsoft Windows.

What specific artifacts did Volexity Volcano detect in the analysis?

The tool detected reflectively loaded DLLs, position-independent shellcode in chrome.exe, and anomalies in system privileges and process relationships.

How does Volexity integrate AI into its forensic analysis?

Volexity uses a Model Context Protocol server to allow AI models, such as GPT-6.1-Sol, to assist in incident response and threat hunting.