We are excited to announce that the 14th Annual Volatility Plugin Contest is officially open for submissions!
The annual Plugin Contest is your opportunity to:
- Directly contribute to the open source forensics community.
- Put groundbreaking capabilities into the hands of digital investigators.
- Gain industry-wide visibility for your work.
- Contribute to an important open-source project.
- Win a cash prize!
The contest is straightforward: Create an innovative and useful extension to Volatility 3. Your submission doesn’t have to be a formal plugin; tools that use the Volatility APIs also qualify, and previously released work is welcome as long as it’s your own.
Submissions for the 14th annual Volatility Plugin Contest will be accepted until December 31, 2026. Winners will receive over 6000 USD in cash prizes!
Click here for the full contest details, including the rules of engagement and FAQs. You can also scroll through the roll call of all past submissions. See how many you recognize!
If you are looking for inspiration, check out last year’s Volatility Plugin Contest Results (2025).
Supporting the Community
Our commitment to the open-source community is unwavering. Events like FTSCon are powered by the collaborative spirit of researchers who choose to share their findings openly to make the entire ecosystem more resilient.
Over the last two years, we hosted an incredible cadre of researchers who have pushed the boundaries of memory forensics, kernel security, and threat intelligence. We are honored to have hosted a slate of amazing speakers doing great things!
We encourage everyone to revisit the technical deep dives and research presentations from our past speakers, many of which were recorded and are available on the Volatility Foundation YouTube Channel.
As you attend other conferences this year, we highly encourage you to seek out these speakers, engage with their research, and support the open-source tools they maintain.
Keynote
The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access
Track Speakers
- Andrew Case | Volexity
Detecting & Defeating EDR-Evading Malware with Volatility 3
X | Bluesky | LinkedIn | Mastodon - Brad Spengler | Open Source Security, Inc.
X | Bluesky | LinkedIn - David Millar | National Security Agency, Research Directorate
Ghidra + Volatility – Adventures in Kernel Debugging - Greg Lesnewich | Proofpoint
Holding a GRUdge: Phishing Campaigns Outside the Warzone
X | Bluesky | LinkedIn - Harlan Carvey | Huntress
Design and Use of RegRipper 4.0
Bluesky | LinkedIn | Website - James Elliott | Microsoft Threat Intelligence Center (MSTIC)
- Jaron Bradley | Jamf
Grafting Trees with macOS
X | LinkedIn - Jimmy Wylie | Dragos
TRISIS to FrostyGoop: Misconceptions, Realities, and Skills in ICS Malware Analysis
X | Bluesky | LinkedIn | Mastodon - John Hammond | Huntress
Malware ExtravaScamza
X | Bluesky | LinkedIn | Mastodon - Lex Crumpton | MITRE
ATT&CKing the MITRE NERVE Incident: Operationalizing Threat Intelligence for a Safer Tomorrow
X | LinkedIn - Mikhail Sosonkin | DoubleYou
Heuristically Detecting Modern macOS Malware
X | LinkedIn - Tom Hegel | SentinelOne
X | Bluesky | LinkedIn - Tom Lancaster | Volexity
It Has Been [0] Days Since the Last Edge-Device Security Incident
X | Bluesky | LinkedIn - Yarden Shafir
Forensics in the Age of Enclaves
X | Bluesky
Keynote
Adventures of Wallet Hacking
Track Speakers
- Aleksandra Doniec | Malware Researcher, Open Source Developer
X | Bluesky | Website - Andrew Case | Volexity
Detection and Analysis of Memory-Only Linux Rootkits
X | Bluesky | LinkedIn | Mastodon - Daniel Gordon | Cyber Threat Intelligence Analyst
X | Bluesky - David McDonald | Volexity
Detecting and Preventing Obfuscated Script Execution with Tree-sitter
LinkedIn - Denis Bueno | Sandia National Labs
CTADL: Customizable Static Taint Analysis
X | LinkedIn - Joe FitzPatrick | SecuringHardware.com
Rethinking DMA Attacks with Erebus
X | Bluesky | LinkedIn - Joseph Edwards | 7AI
The Forensics of Zoom’s Remote Control
LinkedIn - Juan Andrés Guerrero-Saade | SentinelOne
X | Bluesky | LinkedIn - Michael Carson | Sandia National Labs (Creator of Thorium)
Thorium
LinkedIn - Michael Horka | Lumen Technologies | Black Lotus Labs
LinkedIn - Tom Lancaster | Volexity
Mission Auth Possible: Passwordless Phishing
X | Bluesky | LinkedIn - Toni de la Fuente | Prowler
Open Cloud Security, Lessons Learned Building Prowler
X | Bluesky | LinkedIn - Wesley Shields | Google
COLDRIVER: NOROBOT / YESROBOT / MAYBEROBOT
X | Bluesky
Acknowledgements
We would like to thank Volexity and our other sustaining donors for their continued support.
— The Volatility Foundation