Volatility
Volatility is an open-source memory forensics framework typically used by incident responders. In the provided reporting, it was recovered or observed in post-compromise toolsets rather than described as a malicious family itself. Amazon threat intelligence reported Interlock ransomware operators deployed Volatility alongside custom implants, reconnaissance scripts, ConnectWise ScreenConnect, and Certify during exploitation of CVE-2026-20131 in Cisco Secure Firewall Management Center, and assessed its presence as consistent with mature multi-stage intrusion operations. Separately, Unit 42 reported that the China-linked intrusion cluster CL-UNK-1068 used DumpIt together with several Volatility modules, including windows.hashdump, lsadump, and cachedump, as part of credential-access and memory-analysis activity during intrusions targeting high-value organizations across South, Southeast, and East Asia, including government, critical infrastructure, technology, and telecommunications. High-confidence capabilities directly mentioned in the content are memory forensics and use of modules such as windows.hashdump, lsadump, and cachedump. No malware-specific infection vector or standalone IOCs for Volatility are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“DumpIt and Volatility… they used several Volatility modules: windows.hashdump… lsadump… cachedump…”
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Credential Access
2 techniques
Credential Access
Discovery
3 techniques
Discovery
Additional artifacts can also be recovered from the same memory image... network connections can be reconstructed... vol.py -f ram.img netscan
A good starting point for analysis is listing running processes. If the tool can correctly identify processes from the memory image, it is a strong indication that the forensic profile and analysis environment are configured properly.
That toolkit includes a PowerShell script designed to scoop up information about victims' Windows environments, such as... installed software... In addition to using custom malware, the ransomware slingers also deployed legitimate software... Volatility; and Certify...
Collection
3 techniques
Collection
Additional artifacts can also be recovered from the same memory image... screenshots of the desktop environment may even be present if graphical buffers remain in memory... vol.py -f ram.img screenshot -D .
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Volatility is a legitimate memory forensics framework found in the Interlock toolkit. In this context it may support credential access and deeper compromise by parsing memory dumps during ransomware intrusions.
Memory forensics framework used here to extract NTLM hashes and LSA secrets from acquired memory images.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.