Volexity Cyber Sessions – Amsterdam | October 2026
Join Us in Amsterdam
We are excited to announce our first Volexity Cyber Sessions meetup in Amsterdam!
Seating is limited for this in-person event. Register now to secure your spot!
Agenda
15:00 Registration & Welcome
15:45 Keynote
16:30 Break & Refreshments
16:45 Talks
18:30 Reception & Dinner
Be sure to register to get upcoming announcements.
Speaker Lineup
Keynote
Mind the (Patch) Gap: When Fixed Vulnerabilities Are 0-Days
Steven Adair | Volexity
A vulnerability can be patched and still be a zero-day for millions of users.
Volexity co-founder and president Steven Adair will deliver the keynote on multiple cases from September 2026, when Volexity uncovered three distinct Chinese threat actors exploiting Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) vulnerabilities.
The Chrome vulnerabilities had already been fixed upstream in Chromium—but hadn't yet reached a public Chrome release—potentially allowing the threat actors to compromise fully up-to-date users. The identical exploit code reused across otherwise unrelated operations points to a shared supplier.
Steven will reconstruct these campaigns, tracing the exploit from upstream patch to active deployment and examining the evidence linking the operators despite their different infrastructure, targeting, and tooling, including a false-flag campaign designed to pin the blame on a Russian threat actor. The talk covers what this reveals about exploit supply chains, the risks created by the patch gap, and the attribution challenges posed when capabilities are shared between threat actors.
Steven Adair is a founder and president of Volexity Inc., an information security firm specializing in assisting organizations with incident response, digital forensics, threat intelligence, network security monitoring, and trusted security advisory.
Steven currently leads a team of experts that frequently deal with advanced and complex cyber intrusions from nation-state level intruders targeting everyone from small think tanks to large global defense contractors.
Prior to Volexity, Steven was the Director of Cyber Intelligence at Verizon Terremark, where he built and led their external incident response services and efforts to track emerging and advanced threats with a core focus on activity related to cyber espionage.
Prior to working at Verizon Terremark, Steven ran the Cyber Threat Analysis Program within the Office of the CIO at NASA. The goal of this program was to provide computer network defense (CND) by proactively detecting, mitigating, and preventing advanced targeted attacks and cyber-intrusions across the Agency.
Steven is also a co-author of the book "Malware Analyst's Cookbook".
Opening the Black Box: An Agentic Approach to Memory Forensics
Roey Shua | Rio Security
Edge devices (routers, IoT endpoints, network appliances) are increasingly central to intrusions, yet they remain among the hardest forensic targets.
Roey Shua will be speaking about whether edge device forensics, and volatile memory analysis in particular, can be automated.
Roey will walk through an agentic framework that fingerprints an unknown networked device, selects a viable acquisition path for its architecture and kernel, and reconstructs the symbol information needed for analysis, including a proof-of-concept extending Volatility 3 to support a MIPS-based router it does not natively handle.
Roey Shua is a Security Researcher with years of experience in diverse roles in the Israeli Public Sector and Silicon Valley. Over the past few years, he has led the field of Forensic Incident Response within Check Point's Research Group (CPR), investigating unique activites of sophisticated threat actors.
Currently at Rio Security, he is focusing on applying agentic AI systems to real-world security operations.
Paste to Proceed -> macOS Malware
Christopher Lopez | Volexity
As macOS grows in the enterprise so does attacker interest.
Christopher Lopez will be speaking about the current macOS threat landscape, including the lures, targets, and recently discovered malware families shaping this space.
Christopher will walk through commonly observed behaviors and artifacts used to drive disk and memory forensic analysis of a potentially compromised macOS system, and how these findings can be translated into durable detection strategies.
Christopher Lopez is a Staff Security Engineer at Volexity that specializes in macOS/iOS malware. He has a passion for reverse engineering and teaching and talking about arm64 assembly (sometimes a little too much). Other hobbies outside of analyzing malware include BJJ and drifting.
Targeting Europe: APT in 2026
Feike Hacquebord | TrendAI
State-aligned threat actors continue to evolve their operations and infrastructure tactics.
Feike Hacquebord will be speaking about APT campaigns by Russia-, China-, and DPRK-aligned actors targeting Europe in 2026.
Feike will examine China-aligned residential proxy networks built on compromised IoT devices, DPRK-aligned operations run from static Russian IP addresses and hundreds of VPS servers, and a decade of Pawn Storm (APT28/Fancy Bear) activity. He will also explain how domestic Chinese AI capabilities have reduced China-aligned actors' dependence on frontier Western models.
Feike Hacquebord has more than 20 years experience in doing threat research as a Senior Threat Researcher. Since 2005, he has been a regular advisor of international law enforcement agencies and has assisted in several high-profile investigations. He is the author of more than a dozen blog postings and papers on advanced cyberattacks.
Prior to joining Trend Micro, he earned a Ph.D. in theoretical physics from the University of Amsterdam.
About Volexity Cyber Sessions
This is an opportunity to get an insider’s look at our latest research, and to learn from industry experts who want to present their work to the cybersecurity community.
When we were starting the Volatility open source project, we benefitted from the numerous security meetups that used to be common. We want to bring back that community experience, so we are hosting this forum to bring the talks and speakers you see at the leading cyber security conferences here to the local community.
The sessions will be hosted periodically by Volexity and will cover topics related to threat intelligence, digital forensics, and incident response. Our goal is to have speakers from the local community and cyber security experts from around the world.
Please let us know if you have topic recommendations, speaker suggestions, or overall feedback!
Food, Drinks & Venue
Dinner and drinks are provided at no cost to attendees. After the talks, stay for the reception to enjoy a meal, a drink, and conversation with speakers and fellow members of the security community.
This event takes place at Helling 7, a restaurant and event space in a former shipyard building on Amsterdam's IJ waterfront, in the historic NDSM Wharf. Surrounded by ships and cranes, the venue combines its industrial past with a modern, relaxed atmosphere. The kitchen cooks over fire using carefully selected local ingredients, and the bar pours local beers on tap.
Getting there
Helling 7 is easy to reach by car, with a large parking area available at no cost. You can also take the free GVB ferry from Amsterdam Centraal to NDSM, which takes about 15 minutes and runs regularly throughout the evening.