The Speakers

KEYNOTE “Looking back on 40 years of anti virus experience”

Since 1985 Christoph Fischer is working in the field of IT security. In 1987 he started the MicroBIT Virus Center at the University of Karlsruhe, the first emergency response team (CERT) in Germany. 1990 he founded BFK edv-consulting GmbH. His company is providing support in cases of computer emergency, forensic investigation and is consulting companies in topics of IT security, malware protection, network security and APT and Ransomware response. BFK has a sensitive clientele from industry, finance and insurance as well as governmental and public organisations worldwide. Christoph Fischer was member of the board of directors at FIRST and co-founder of the european IT-security organisations CARO and EICAR.

How macOS Malware Outsmarts Apple’s Security

As Apple continuously enhances the security architecture of macOS, threat actors have been forced to develop increasingly innovative techniques to bypass the system’s built-in defenses. macOS relies on a multilayered protection model, which includes code signing policies, system integrity verification and granular permissions. In theory, these mechanisms work together to prevent unauthorized software execution and control application access to system resources, creating a robust security environment that minimizes the risk of compromise. However, ongoing research reveals that adversaries keep finding clever approaches to adapt and to circumvent these safeguards. This paper analyzes the most recent evasion techniques employed by macOS malware, highlighting how attackers exploit trust boundaries and system design assumptions. Furthermore, it provides practical insights and defensive guidelines, aiming to enhance the overall system protection.

Andrei Lapusneanu is a Security Researcher in Bitdefender’s Cyber Threat and Intelligence Labs, with over 4 years of experience in Unix security, including anti-malware technologies, endpoint detection and response (EDR) and sandboxing systems. Andrei completed both his bachelor’s and master’s studies in Computer Science at Alexandru Ioan Cuza University of Iași, where his work focused on macOS security. His research focuses on advanced threat hunting techniques, malware investigations and reverse engineering, driven by a strong desire to stay ahead of cybercriminals.

Unmasking AI-Themed Malvertising Targeting Social Media Users

Social media platforms provide cybercriminals with significant opportunities to launch malicious attacks against unsuspecting users. One prevalent infection vector is malvertising, where threat actors craft compelling posts tied to trending topics, such as generative AI or major global events, and exploit ad networks to maximize their reach. These deceptive posts often include links to fraudulent domains impersonating legitimate AI tools, enticing users to download and install malicious payloads. These payloads typically contain info-stealers capable of exfiltrating sensitive personal data, such as login credentials or financial details, which can be used to gain unauthorized access or hijack victims’ social media accounts.

In this presentation, we examine the current landscape of malvertising on social media platforms and analyze the most common techniques employed by cybercriminals to deceive users. We will focus on a prolific AI-themed malvertising campaign, dissecting its entire infection chain from initial engagement to payload delivery. Examples of fake and hijacked Facebook pages, boosted malicious posts, and distributed malicious packages will be presented. We will demonstrate our approach to analyzing these often multi-layered, obfuscated packages and extracting critical artifacts, such as campaign IDs and command-and-control (C&C) servers, from the samples.

Additionally, we will analyze several notable malware families observed in the wild, including:

a) Remote Access Trojans (RATs) like PureHVNC with advanced data-stealing capabilities
b) Information stealers, such as Noodlophile, written in .NET or Python

Finally, we will share our threat-hunting techniques and discuss the primary targets of these campaigns, providing insights into mitigating such threats.

Jaromír Hořejší is a Security Researcher at Check Point Research, specializing in tracking and reverse-engineering threats, including APTs, DDoS botnets, banking trojans, click fraud, and ransomware targeting Windows and Linux systems. His work has been presented at leading conferences such as RSAC, SAS, Virus Bulletin, HITB, FIRST, AVAR, Botconf, and CARO.

APT’s playing with Roblox and Minecraft (amongst other sector specific platforms)

Godert Jan joined Lucas Education in February 2025, becoming responsible for cybersecurity within the foundation. His daily security operations include (amongst other things) analyzing and resolving cybersecurity incidents. In his work, he has encountered state actors and cybercriminals using advanced tools to compromise educational institutions.

Education, like many other sectors, is increasingly reliant on ICT. Digital resources are increasingly being used for teaching, cloud environments are often used for administrative processes, and digital systems and school organizations process personal information about students and staff. Student data can be compromised, and the continuity of education can be jeopardized if systems become inaccessible.
Schools themselves process personal data: that of employees, their students—who are often minors—and that of students’ parents. There are increasing data flows containing sensitive information about students. Schools must handle this data carefully. Administrators are responsible for ensuring this is done securely. In this talk, he is going to show advanced groups infiltrating the education sector. Showing how on first sight education and recreational platforms, that appear to be innocent, being used to distribute and compromise sensitive information from a sector that in most cases is not able to defend itself against. The presentation will go over a sector specific analysis of advanced targeted malware and techniques.

Godert Jan van Manen is a seasoned cyber security, technology risk and control specialist with over 25 years of hands-on experience, guiding organizations through complex challenges. His career has spanned critical areas such as technology design, large-scale implementations, migrations, and disaster recovery teams — all while keeping security, governance, and compliance at the forefront at diverse commercial companies and government institutions
With a deep understanding of risk management frameworks and control principles, Godert Jan has helped businesses across diverse industries strengthen their defenses against evolving cyber threats. He is known not only for his technical expertise but also for his ability to translate complex security concepts into clear, actionable strategies that resonate with executives and teams alike. Calm under pressure and focused on alignment with business objectives, Godert Jan brings both strategic insight and practical experience to the table — making him a trusted voice on how organizations can thrive in an increasingly digital and risk-laden world.

No Payload For You: Inside Sidewinder’s Selective Exploitation Strategy

Active since at least 2012, Sidewinder has carried out sustained and highly targeted espionage campaigns across Southeast Asia. Often labeled as unsophisticated, the group instead demonstrates strong operational discipline and a clear focus on precision targeting. In this presentation, we share new research into Sidewinder’s tooling, infrastructure, and delivery methods, based on recent campaigns targeting government ministries, military entities, public institutions, and financial organizations.
Through multi-stage spear-phishing, geofenced payload distribution, and sandbox evasion, Sidewinder ensures that only its intended victims receive the actual malware while analysts are left with nothing to work with. The group’s infrastructure fingerprints each request and generates unique payloads per victim, leaving minimal evidence behind.
Our investigation reveals highly customized intrusion chains, obfuscated shellcode, and staged malware deployed via trusted executables and DLL sideloading. We also explore potential overlaps with other regional APTs such as SideCopy and related clusters, highlighting shared techniques, tactics, and procedures.
Attendees will gain insights into Sidewinder’s evolving playbook, practical detection strategies, and a broader understanding of its place within the regional APT landscape.

Eliad Kimhy is a Senior Security Researcher at Acronis, where he focuses on cybersecurity research, threat intelligence, and communicating findings through published reports, conference talks, and media engagements. Eliad has worked with security teams for close to a decade, helping build and lead the development of threat intelligence production, and the publication of research-based content for technical and general audiences.

He is the co-creator and producer of the Webby Honoree podcast Malicious Life, which explores the history of cybersecurity. Eliad has spoken at conferences including Insomnihack, Thotcon, BsidesSF, BsidesLV, and IT-SA.

Threats and COM interfaces

The Component Object Model (COM) is one of the fundamental technologies in the Windows operating system, facilitating interprocess communication and dynamic object creation across different programming languages.

While COM is widely used for legitimate software development, its capabilities have also been used by threat actors, from APTs to cybercrime actors, to carry out malicious activities.

This presentation is a result of research on threat actors using COM interfaces for lateral movement, command and control (C2) communications, data exfiltration, persistence, code execution and other TTPs, specifically focusing on analysing compiled code employing those interfaces.

The attendees will learn about the COM interfaces used by threat actors as well as strategies for reversing them to understand the code which is often hidden behind indirect calls into offsets of COM objects virtual function tables.

Vanja Svajcer works as a Threat Researcher at Cisco Talos. Vanja enjoys tinkering with automated analysis systems, reversing binaries and analysing mobile malware. He thinks time spent scraping telemetry data to find indicators of new attacks is well worth the effort. He presented his work at conferences such as FSec, Bsides, Virus Bulletin, RSA, CARO, AVAR, BalcCon and others.

The Rise of the AI-Orchestrator: New Modus Operandi of Cyber Adversaries

Adversaries are shifting from using AI as a tool to deploying it as the orchestration brain of their attacks. Large language models (LLMs) are no longer limited to generating phishing emails or snippets of code; they now act as planners that sequence high level attack verbs and delegate execution across cloud, identity, and endpoint environments. This structural change, once only described in research, is now being observed in real world operations. Recent academic work has shown that even smaller models, when constrained to a limited set of verbs, given memory of state, and separated into planning and execution layers, can reliably coordinate multi host operations. Threat actors mirror these same principles: some jailbreak commercial LLMs into planner roles using prompt libraries, while others build orchestration wrappers around open source models that link reconnaissance, phishing kits, and obfuscation tools. The novelty lies not in the models themselves but in the orchestration layers that lower the skill barrier and expand operational reach. Two case studies highlight this evolution. The first examines Hexstrike AI, which attackers use to exploit Citrix Netscaler vulnerabilities, showing how orchestration driven planning accelerates zero day exploitation. The second describes an AI powered IDE compromised because it lacked orchestration safeguards; without provenance checks or runtime validation, a poisoned configuration enabled persistent remote code execution. In both cases, orchestration determined reliability. To close, we introduce a defensive design called Signed Intent Orchestration, which enforces short lived signed intents, runtime re attestation, provenance labeling, and attack graph gating. Attendees will leave with schemas, policies, and a test harness for securing AI ecosystems, and a new mental model for defense in the age of orchestration.

Amit Weigman is a Senior Solution Architect at Cyberint, a Check Point company, where he works with organizations worldwide to help them understand and respond to fast-evolving cyber threats. His background combines years of field experience, both technical and strategic, with a data science mindset that helps him make sense and his work, and focus on applying that expertise to the unpredictable, high-stakes environments of cybersecurity.
Earlier in his career, Amit served for many years in Unit 8200, Israel’s elite military intelligence unit known for its leadership in cyber operations, SIGINT, and technological innovation. There, he led teams responsible for operational intelligence missions that impacted both national security and global digital infrastructure. His experience spans everything from threat detection and analysis to coordinating complex intelligence workflows, all under high-pressure and mission-critical conditions.
In the past years Amit’s research has been focusing on areas of the threat landscape that are often overlooked—from access brokers and ransomware supply chains to the infrastructure behind nation-state and proxy actors. His recent work includes a comparative analysis of cyber activity across major geopolitical conflicts, including Russia–Ukraine and Israel–Hamas, examining how cyberwarfare is reshaping the way global power is projected online. His insights have been featured at leading international conferences such as RSA, IT-SA, and Infosec, as well as in articles and interviews published by outlets like SC World and Ampyx Cyber News.

This topic cannot wait until next year. Attackers are already using orchestration layers to turn AI into the brain of their operations, yet this has not been presented on stage. This session is the first to connect underground adoption, academic validation, and a defensive blueprint with concrete, actionable guidance.

Decrypting AI-Powered™ and Recycled Ransomware – Facepalms Included

We all know what ransomware is and how destructive it can be. At Gen, we’ve been working on ransomware since its earliest days and, since 2016, we’ve also been helping victims recover by providing free decryption solutions. Over the years, we’ve built tools for more than 40 ransomware families and supported victims worldwide.

While ransomware is a very serious kind of malware, decrypting it often brings surprising moments of fun. From time to time, we also share our experiences with the community, such as four years ago at CARO 2022.

In this presentation, we promise 100% new content and an even bigger dose of entertainment. Expect insights such as how to defeat AI ransomware™, how reusing leaked source code can introduce not just one but three fatal mistakes, and plenty more.

We will share our experience with decrypting two ransomware strains, Midnight and FunkSec. It’ll be a technical talk but presented in a funny and relaxed way.

Midnight Ransomware: An Innovative Set of Bugs
The first half of the presentation will show Midnight ransomware strain, that we discovered in our userbase. We will describe the surprisingly poor implementation of cryptography.

FunkSec Ransomware: AI Won’t Compensate Low Engineering Skills
The second part of the presentation will describe FunkSec ransomware, which had about 110 victims during its active phase. It’s been considered dead since March 2025. We will demonstrate that even though ransomware is believed to be written with the help of AI, it is not enough when the developers have poor coding skills and insufficient knowledge in cryptography.

At the time of sending this annotation, Midnight decryptor is TLP: RED, which has not been published so far.

Ladislav Zezula is a senior malware analyst at GEN. Ladislav has been a malware analyst since 2006, working for Grisoft, then AVG, then Avast, now GEN. His area of expertise includes malware analysis, reverse engineering, Windows internals, and system tools. He contributed to the creation of a Win32 and Win64 emulator, removal tools for file infectors, new features in YARA, and ransomware decryption tools.

Samuel Vojtáš is a malware researcher focused on ransomware processing, analyzing and decryption. He joined the team of malware researchers three years ago and gained significant experience since then.

The Hunter Becomes the Hunted

Fighting cybercriminals is a never-ending battle, where it is not obvious, who has the upper hand.
Sun Tzu wrote: “If you know the enemy and know yourself, you need not fear the result of a hundred battles”. Criminals most certainly follow his advice and don’t go unprepared into the battle.
In the past we have observed a couple of times as attackers registered test user accounts to figure out the extent of our defensive capabilities, find loopholes where they could bypass the protection.

This initiated a systematic identification through behavioral analysis and correlation techniques. As a result we found anomalous user accounts in multiple clusters operated by distinct threat actor categories, exhibiting patterns consistent with adversarial testing activities.

This presentation will cover our experiences in tracking the activities of the threat actors. We will explain how we could identify the suspicious accounts.

We will describe a couple of typical cases:
• A suspected pentester trying new tools
• A suspected ransomware affiliate probing our defensive capabilities
• A suspected APT group using a series of accounts as a testing ground
This should not come as a surprise, criminals have been doing this for quite some time. But is there something that we can turn to our advantage?
To continue the famous quote: “If you know yourself but not the enemy, for every victory gained you will also suffer a defeat”.
Defenders don’t want to be in this position. We have to be equally prepared with knowledge about the bad guys. With that in mind, we were analyzing the information coming from these test account with the specific focus on using it to improve our defenses. Some of the tools they experimented with, later turned out in real world attacks against our users.
This presentation details our counter-intelligence approach, transforming adversarial testing activities into defensive advantages with the purpose of better protection for our customers.

Cybercrime on the ground: Observations of experiences from the digital frontlines

TBA

The dark prescription: inside the infrastructure of illegal online pharmacies

TBA

Evasion by Design: How APT Operations Slip Past Defenses

APT tradecraft is converging on invisibility. Operators increasingly weaponize identities, signed components, and “living off the land” to shape telemetry and blend in. This talk maps the evasion techniques we’re observing against government agencies globally and the operational patterns enabling them. The talk is structured around three facets of this evolving tradecraft:

Hijacking Trust in Plain Sight explores how attackers leverage legitimate infrastructure as an operational proxy between victims and their C2 servers. By exploiting reputable webservers, they blend seamlessly into trusted environments, complicating attribution and takedown efforts. Notable examples include Curly Comrades – APT known for its creative abuse of legitimate websites to relay commands and exfiltrate data.

Building on this theme of stealth, defeating EDR with Subtlety highlights a new version of the EagerBee backdoor, which demonstrates the use of a Windows kernel driver instead of standard socket API calls, thereby avoiding the conventional API hooks and telemetry sources monitored by most security solutions. Beyond the EagerBee backdoor, APT operations have leveraged Windows virtualization technologies to evade detection. In these cases, attackers enabled Hyper-V, imported custom virtual machines containing malicious tools, and executed them in isolation – effectively bypassing host-level monitoring and EDR visibility.

Taking evasion even further, Blinding the Defenders examines operations where adversaries turn defenders’ trust against them. Techniques include concealing SSH activity through carefully crafted configurations and commands that appear entirely benign, and the UAC-0063 group tweaks to their signature malware.

Together, these cases reveal a striking trend: today’s APT operations don’t overpower defenses – they co-opt trust itself. By blurring the line between legitimate and malicious behavior, they make defenders question what can truly be trusted.

Marius Andrei Baciu is a cybersecurity professional with three years of experience at Bitdefender, specializing in Digital Forensics and Incident Response (DFIR). He is passionate about uncovering complex security incidents, continuous learning, and applying hands-on investigation techniques. Outside of work, Marius enjoys building and experimenting in his homelab, exploring new technologies, and refining his technical skills through personal projects.

LLMpot: Exploring the Open Frontier – A Study of Local AI Accessibility and Potential for Misuse

The increasing accessibility of local Large Language Model (LLM) solutions, such as LM-Studio and Ollama, presents a rapidly evolving landscape for AI development and deployment. While these tools democratize access to powerful AI capabilities, they currently lack inherent access controls, creating a potential vulnerability. Consider the scenario: an individual with limited computational resources rents a public server to run one of these open-source LLMs, inadvertently exposing it to unrestricted access. This raises critical questions about the potential for misuse and the implications of open accessibility in this emerging space.
This talk will delve into these questions through LLMpot, a non-AI powered project designed to investigate the real-world implications of unrestricted local LLM access. Over the past months, I have deployed LLMpot to observe and analyze such usage patterns. I will share and discuss insights gathered during this ongoing research project.

Marco Preuß is a seasoned cybersecurity strategist with over 18 years of experience in global threat intelligence. He held senior leadership roles at a leading international security company, including Deputy Director of Global Research & Analysis and Director for Europe.

A technology pioneer with a two-decade career, Marco’s expertise spans threat intelligence, malware analysis, and the analysis of emerging cyber risks. He has a proven track record of developing proactive defense strategies and advising global organizations on advanced security measures. He is a frequent speaker at international cybersecurity events, advocating for robust threat detection and response.

Marco’s career is driven by a commitment to innovation, bridging the gap between research and practical security solutions to help organizations stay ahead of evolving digital threats.

Costin Raiu is a cyber paleontologist and researcher specializing in
analyzing advanced persistent threats and high-level malware
attacks. He is a founder at “Art of Noh”, a visionary think-tank
dedicated to the advancement of cybersecurity and founder at
“TLPBLACK”, a boutique cybersecurity consulting and intelligence
company. Before this, he led GReAT, the team that researched the
inner workings of Stuxnet, Flame, Duqu, Turla, Lazarus or
Moonlight Maze.

Costin has over 30 years of experience in ITSec, having written his
first antivirus when was 16. He is a member of the Virus Bulletin Technical Advisory Board, a member of the Computer AntiVirus Researchers’ Organization (CARO) and a founding member of the MUTE Group.

Costin enjoys playing chess, taking photos and reading science fiction literature. He holds a black belt in Taekwondo.

Exploring the ecosystem of ContagiousInterview and North Korean IT workers

ContagiousInterview, also known as DeceptiveDevelopment, is a North Korea-aligned threat actor operating since late 2023, actively focused on cryptocurrency theft, primarily targeting freelance developers with multiple malware families and social engineering tactics.
This presentation gives an overview of how the activities, tactics and techniques of this threat actor have developed over time – from simple cryptocurrency stealing malware to sophisticated social engineering schemes and complex payloads, including their most recent campaigns, deceiving job searchers, cryptocurrency investors and many others.

We also shed light on the North Korean IT worker fraud operation recently disclosed by, among others, the US government and the FBI. We explore their connection to ContagiousInterview, including new developments in the tactics and techniques of the IT workers themselves. We investigate their organizational and operational structure, showing that their targeting has expanded to cover more than just IT work, providing an insight into how to identify and prevent such intrusions.

Matej Havranek is a threat intelligence researcher at SentinelOne with 10 years of experience in the fields of malware analysis and threat hunting. He has presented his past research at conferences like Virus Bulletin and AVAR. He is a fan of ciphers and cryptography, and enjoys challenges.
Can be expanded into a 40min deep dive with more details about the inner workings of malware and network infrastructure used by the threat actors, if preferred.

Peter Kálnai is a senior malware researcher at ESET. As a speaker, he has presented his malware research at various international conferences including Virus Bulletin, AVAR and CARO Workshop. He earned his Ph.D. in mathematics at Charles University in Prague in 2020. Outside of work he enjoys spending time with his family.

Attic Shinobi: Persistent Listening for Adversary Fingerprints

For more than six months, we have continuously received data leaking from attackers’ C2 servers and admin panels, allowing us to study their activity in near real-time. WaterPlum (also known as Famous Chollima), a DPRK-nexus group, made implementation and operational mistakes in their use of WebSocket. As a result, not only victim data but the attackers’ own operational data has been leaking externally.

In this talk, we show how we leveraged these mistakes to gather data persistently and track behavioural changes: shifts in geographical footholds, the evolution of IP ranges and network routes, and even the use of mobile networks near national borders. We also demonstrate concrete ways to feed these findings back into defence for detection, alerting and incident response.

Attendees will learn a new research method for malware and tooling that use WebSocket, and gain a near-current view of the operations of a nation-state-backed actor.

Rintaro Koike is a security researcher at NTT Security Holdings. He is engaged in threat research and malware analysis. In addition, he is the founder of “nao_sec” and is in charge of threat research. He focuses on APT attacks targeting East Asia and web-based attacks. He has given over 30 presentations at over 10 international conferences, such as VB, Botconf, FIRST, AVAR and others.

Masaya Motoda is a security researcher at NTT Security Holdings, where he is primarily involved in log analysis and malware analysis. He has spoken at JSAC in the past, and has written several blog posts.

Cyber Kill Chain 2026.
The good, the bad and the worst

The Cyber Kill Chain model has long been a benchmark for understanding how today’s multi-phase cyberattacks work. This model allows us to visualize the life cycle of a cyberattack, identify detection points, and apply specific defenses at each stage. Attackers are constantly modifying their techniques, tactics, and procedures, so it is important to be aware of current trends in order to be properly protected.
In this presentation, we will show recent examples of cyberattacks and explain the techniques commonly used by cybercriminals, as well as the most effective strategies for interrupting the cyberattack chain and minimizing its impact, providing companies and professionals with a clear perspective for dealing with the threats we saw during last months.
We will focus mainly on techniques recently observed, analyzing both attack vectors that have proven their worth over many years and more recent ones, such as ClickFix or the use of AI to generate adaptive malware, which are gaining ground in the cybercrime scene. Also, we will provide several examples of malware campaigns that have been observed targeting European individuals and business, including the increase of the detection of several infostealers campaigns that provided sensible credentials to be used later in ransomware attacks, putting many companies around the world on the bullseye of several of these ransomware families.

The three main focuses of the presentation:
1. Examine how the Cyber Kill Chain framework remains central for understanding and mitigating multi-phase cyberattacks in today’s threat environment. 
2. Present concrete examples of recent malware campaigns, with a focus on credential theft and ransomware.
3. Provide defensive and mitigation measures against attacks.

Josep Albors is the Head of Awareness & Research at Ontinet.com, a Spanish company focused on cybersecurity solutions and services provider. He’s a security expert with more than 20 years working in cybersecurity and specialized in security awareness.
He has been a frequent speaker at the most important security conferences in Spain and other countries such as AVAR conference in Osaka in 2019, Caro Workshop 2023 in Bochum (Germany), FIRST 2024 (Fukuoka), Virus Bulletin 2024 (Dublin), JSAC 2025 Lightning Talks (Tokyo) or Defcon 33 Malware Village (Las Vegas). He’s also a teacher in cyber security expert courses at several Spanish universities and participates in several conferences organized by universities in Spain and Latin America and other governmental organizations such as INCIBE.

Josep has also collaborated with the Spanish Guardia Civil, Spanish National Police and the Spanish Army, teaching their units on how to fight cybercrime and with cyber intelligence training, contributing with his experience in analyzing cybercrime and malware.