The 14th Annual Volatility Plugin Contest is Open!

We are excited to announce that the 14th Annual Volatility Plugin Contest is officially open for submissions! The annual Plugin Contest is your opportunity to: - Directly contribute to the open source forensics community. - Put groundbreaking capabilities into the hands of digital investigators. - Gain industry-wide visibility for your work. - Contribute to an important open-source project. - Win a cash prize! The contest is straightforward: Create an innovative and useful extension to Volatility 3. Your submission doesn’t have to be a formal plugin; tools that use the Volatility APIs also qualify, and previously released work is welcome as long as it’s your own. Submissions for the 14th annual Volatility Plugin Contest will be accepted until December 31, 2026. Winners will receive over 6000 USD in cash prizes! Click here for the full contest details, including the rules of engagement and FAQs. You can also scroll through the roll call of all past submissions. See how many you recognize! If you are looking for inspiration, check out last year’s Volatility Plugin Contest Results (2025). Supporting the Community Our commitment to the open-source community is unwavering. Events like FTSCon are powered by the collaborative spirit of researchers who choose to share their findings openly to make the entire ecosystem more resilient. Over the last two years, we hosted an incredible cadre of researchers who have pushed the boundaries of memory forensics, kernel security, and threat intelligence. We are honored to have hosted a slate of amazing speakers doing great things! We encourage everyone to revisit the technical deep dives and research presentations from our past speakers, many of which were recorded and are available on the Volatility Foundation YouTube Channel. As you attend other conferences this year, we highly encourage you to seek out these speakers, engage with their research, and support the open-source tools they maintain. Keynote The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access Track Speakers - Andrew Case | Volexity Detecting & Defeating EDR-Evading Malware with Volatility 3 X | Bluesky | LinkedIn | Mastodon - Brad Spengler | Open Source Security, Inc. X | Bluesky | LinkedIn - David Millar | National Security Agency, Research Directorate Ghidra + Volatility – Adventures in Kernel Debugging - Greg Lesnewich | Proofpoint Holding a GRUdge: Phishing Campaigns Outside the Warzone X | Bluesky | LinkedIn - Harlan Carvey | Huntress Design and Use of RegRipper 4.0 Bluesky | LinkedIn | Website - James Elliott | Microsoft Threat Intelligence Center (MSTIC) - Jaron Bradley | Jamf Grafting Trees with macOS X | LinkedIn - Jimmy Wylie | Dragos TRISIS to FrostyGoop: Misconceptions, Realities, and Skills in ICS Malware Analysis X | Bluesky | LinkedIn | Mastodon - John Hammond | Huntress Malware ExtravaScamza X | Bluesky | LinkedIn | Mastodon - Lex Crumpton | MITRE ATT&CKing the MITRE NERVE Incident: Operationalizing Threat Intelligence for a Safer Tomorrow X | LinkedIn - Mikhail Sosonkin | DoubleYou Heuristically Detecting Modern macOS Malware X | LinkedIn - Tom Hegel | SentinelOne X | Bluesky | LinkedIn - Tom Lancaster | Volexity It Has Been [0] Days Since the Last Edge-Device Security Incident X | Bluesky | LinkedIn - Yarden Shafir Forensics in the Age of Enclaves X | Bluesky Keynote Adventures of Wallet Hacking Track Speakers - Aleksandra Doniec | Malware Researcher, Open Source Developer X | Bluesky | Website - Andrew Case | Volexity Detection and Analysis of Memory-Only Linux Rootkits X | Bluesky | LinkedIn | Mastodon - Daniel Gordon | Cyber Threat Intelligence Analyst X | Bluesky - David McDonald | Volexity Detecting and Preventing Obfuscated Script Execution with Tree-sitter LinkedIn - Denis Bueno | Sandia National Labs CTADL: Customizable Static Taint Analysis X | LinkedIn - Joe FitzPatrick | SecuringHardware.com Rethinking DMA Attacks with Erebus X | Bluesky | LinkedIn - Joseph Edwards | 7AI The Forensics of Zoom’s Remote Control LinkedIn - Juan Andrés Guerrero-Saade | SentinelOne X | Bluesky | LinkedIn - Michael Carson | Sandia National Labs (Creator of Thorium) Thorium LinkedIn - Michael Horka | Lumen Technologies | Black Lotus Labs LinkedIn - Tom Lancaster | Volexity Mission Auth Possible: Passwordless Phishing X | Bluesky | LinkedIn - Toni de la Fuente | Prowler Open Cloud Security, Lessons Learned Building Prowler X | Bluesky | LinkedIn - Wesley Shields | Google COLDRIVER: NOROBOT / YESROBOT / MAYBEROBOT X | Bluesky Acknowledgements We would like to thank Volexity and our other sustaining donors for their continued support. — The Volatility Foundation