Program Agenda

Matt Berninger is a Senior VP in the Marsh McLennan Cyber Risk Intelligence Center. In this role he performs cybersecurity research, builds predictive cyber models, and advises customers on cybersecurity strategies. During his 15+ years in cybersecurity he has led teams in Incident Response, Detection and Response, and Data Science in industry, government, and defense. He lives in Denver and enjoys the outdoors, dogs, and math.

Martin (Marty) Leicht is Marsh’s Cyber Claims Transformation Leader and is responsible for executing the firm’s cyber claims advocacy strategy in the United States. Marty assists clients throughout the entire cyber event response process, providing expert claims advocacy to achieve optimal outcomes. Additionally, he serves as a senior advisor for large commercial clients across the country, offering valuable insights on risk identification and complex risk transfer for professional liability and cyber exposures.

Cybersecurity incident response often centers on technical investigation and remediation, but critical aspects of incident management lie beyond the digital forensics and incident response (DFIR) domain. Drawing on real‑world experience as an insurance broker specializing in cyber risk, this talk explores the often‑overlooked operational and strategic elements that can reduce financial losses, streamline response and recovery efforts, and aid successful insurance claim submission.

Attendees will gain practical insights into the cyber insurance ecosystem, managing communication and documentation, coordinating with insurers, and understanding policy nuances. Through real case studies, this session highlights how aligning incident response with insurance considerations improves organizational resilience and financial outcomes. This presentation is designed for incident response professionals seeking to understand how cyber insurance may interact with existing incident workflows.

Rustam is a cyber threat intelligence expert with over nine years of experience in tracking APT and cybercrime groups, leading complex investigations, and assisting law enforcement in identifying threat actors. He is the author of reports and blog posts on Cobalt, Silence, RedCurl, OPERA1ER, and Oktapus (Scattered Spider).

Modern attacks increasingly rely on heavily obfuscated JavaScript droppers and trojans, from NodeJS stealers and WSH droppers to proxy C2 scripts on compromised websites. This makes it hard for incident responders to extract reliable indicators without executing untrusted code and spending days manually deobfuscating the payload. Applying LLMs directly to such samples often leads to hallucinations or missed functionality that is hard to validate.

In this talk, I present an agentic LLM‑assisted framework built on staged Babel transforms that statically deobfuscates JavaScript malware and turns it into structured, incident‑ready intelligence. The LLM inspects the sample, matches it against a catalog of safe, single‑purpose transforms, and incrementally assembles the deobfuscation pipeline instead of editing code directly.

I will walk through real incident samples, showing how this approach transforms heavily obfuscated scripts into readable code while preserving an auditable chain from original script to final analysis and yielding consistent, reproducible, evidence‑grounded results. Attendees will leave with a reusable methodology and patterns they can adapt in their own environments to accelerate malware triage with the help of agentic LLMs constrained by static analysis.

Yukiko Endo is a Senior Technical Researcher at the Cybersecurity Laboratory, National Institute of Information and Communications Technology (NICT) in Japan, where she actively works on darknet monitoring, internet-wide scanning analysis, and threat intelligence research. Before joining NICT, she worked in both Japan and Germany on research and product development in the field of Identity and Access Management. Her broader interests include IoT security, Internet-wide measurement, and the collection and analysis of threat intelligence data.

Masato Jingu is an analyst with the Analysis Team at the Cybersecurity Laboratory of the National Institute of Information and Communications Technology (NICT). He also serves as a member of NICT-CSIRT, where he is primarily responsible for the analysis of a livenet. Prior to joining NICT, he held positions in the private sector, where he was engaged in cybersecurity incident response as well as research and development activities.

Masaki Kubo leads the analysis team at the Cybersecurity Research Laboratory of NICT. His responsibilities extend to both the internal security operation and a darknet monitoring research project known as 'NICTER'. Prior to joining NICT, He was a manager of JPCERT coordination center, focusing on the analysis and coordination of vulnerabilities and advocating for a secure coding initiative.

Security teams routinely waste time investigating benign scans from services such as Censys, Shodan, ZoomEye, and other survey‑scanners. However, there has been no comprehensive, openly available source that identifies which organizations are scanning the global IPv4 space and from which IP addresses.

We operate a large darknet monitoring network and developed a real‑time methodology to classify survey‑scanner traffic and distinguish it from malicious activity. Using this approach, we have identified more than 75 active scanning organizations worldwide.

Our team publishes a quarterly, publicly accessible list of survey‑scanner IP addresses and organizations on GitHub, enabling SOC analysts, incident responders, and network defenders to reduce false investigations and focus on actual threats. We also demonstrate how we integrate this list into our own security operations and quantify its operational impact.

Because many survey‑scanners provide ASM‑related commercial services based on their scanning activity, we additionally highlight behavioral differences among scanners to help practitioners better interpret and validate ASM outputs. Drawing on years of large‑scale darknet monitoring and continuous IP intelligence publishing, we provide practical insights that the community can immediately use to improve alert triage and threat‑hunting accuracy.

Bringing over a decade of experience leading world-class incident response teams, I've had a front-row seat to the ever-evolving landscape of cyber threats. My passion lies in transforming that experience into actionable strategies that empower organisations to not only withstand attacks but emerge stronger.

My expertise spans the full spectrum of incident response, from dissecting malware to orchestrating global investigations involving forensic experts, legal teams, and crisis communication specialists. I thrive on building and leading high-performing teams, fostering a collaborative environment where technical excellence meets strategic thinking.

With 86% of attacks resulting in business impact, there is no one‑size‑fits‑all path to recovery. This session moves beyond theory to present battle‑tested strategies derived from Unit 42’s front‑line experience. We will dissect the critical decision‑making process between Brownfield recovery (remediating the existing estate) and Greenfield recovery (building fresh), helping you determine the right approach for your specific crisis.

Central to this approach is the Sheep Dipping methodology, a rigorous process to sanitise and verify assets. We will demonstrate how to apply this technique to secure your Minimum Viable Business, ensuring that whether you repair or rebuild, you emerge from the incident resilient and response‑ready.

Matheus Fernandes Bezerra – Software Engineer, Apura Cyber Intelligence

Matheus Fernandes Bezerra – Software Engineer, Apura Cyber IntelligenceMatheus Fernandes Bezerra is a Software Engineer at Apura Cyber Intelligence. He holds a Bachelor’s degree in Computer Science from the Instituto Federal de Brasília and is currently pursuing a Master’s degree in Machine Learning at the University of Brasília. Over the past five years at Apura, he has worked across OSINT analysis, cybersecurity operations, and backend engineering.

Matheus Fernandes Bezerra – Software Engineer, Apura Cyber IntelligenceMatheus Fernandes Bezerra is a Software Engineer at Apura Cyber Intelligence. He holds a Bachelor’s degree in Computer Science from the Instituto Federal de Brasília and is currently pursuing a Master’s degree in Machine Learning at the University of Brasília. Over the past five years at Apura, he has worked across OSINT analysis, cybersecurity operations, and backend engineering.Matheus specializes in building scalable security tools, data pipelines, and analytical dashboards that support threat detection, leak monitoring, and exposure intelligence workflows. His work bridges practical incident-response needs with advanced data processing and automation, contributing directly to Apura’s threat intelligence platforms and operational capabilities.

Frank Vieira is the Head of Research and Development at Apura Cyber Intelligence, where he leads the engineering efforts behind the company’s core threat intelligence and exposure monitoring platforms. With more than a decade of experience in software engineering and cybersecurity, he has worked across major Brazilian security companies, including PSafe and GAS Tecnologia, building large-scale systems for threat detection and analysis.

Frank Vieira is the Head of Research and Development at Apura Cyber Intelligence, where he leads the engineering efforts behind the company’s core threat intelligence and exposure monitoring platforms. With more than a decade of experience in software engineering and cybersecurity, he has worked across major Brazilian security companies, including PSafe and GAS Tecnologia, building large-scale systems for threat detection and analysis.At Apura, Frank is responsible for the architecture and development of platforms such as BTTNg and BTTLi, driving innovation in data processing, automation, and security intelligence workflows. His work combines deep technical expertise with a strong focus on practical, operational impact, contributing significantly to the maturity and effectiveness of Apura’s intelligence ecosystem.

Open-source intelligence (OSINT) provides an enormous volume of data from freely accessible sources such as social networks, public channels, forums, ransomware blogs, and paste services. While openly available, this data is highly unstructured, duplicated, and noisy, making deep analysis difficult at scale. These factors make it hard for professionals to navigate the dataset and extract meaningful insights. This work presents a practical, incident response oriented methodology for transforming raw OSINT into structured, actionable context using open tooling, Retrieval-Augmented Generation (RAG), and agentic LLM workflows.

Public events such as: text posts, images, documents, or arbitrary files, are processed through a reproducible pipeline that extracts meaningful features such as identifiers, domain names, URLs, actor names, name of groups, keywords, and contextual metadata. During processing, when new URLs or infrastructure indicators are discovered, an integrated lightweight crawler service collects auxiliary context such as OCR, full screenshot, content and basic network information. All normalized fields and enriched data are indexed in an Elasticsearch stack engineered for high-volume retrieval and efficient filtering across multi-billion-record datasets.

An agentic LLM operates as a structured reasoning layer above this dataset. Rather than functioning as a detector, the model iteratively generates DSL queries, interprets retrieved events, identifies relevant entities, and proposes investigation pivots in a manner consistent with Incident Response workflows. Its outputs are auditable, deterministic in structure with a "permalink" for real event, enabling reproducible analytical steps without reliance on proprietary data.

We present empirical observations from evaluating the accuracy, stability, and failure modes of LLM-generated queries and assessments. The talk focuses on the engineering techniques such as: data normalization, field extraction, RAG architecture, iterative agent design and scaling to work with multiple billions events. It demonstrates how these components together reduce analyst workload and accelerate incident scoping and triage. The methodology is fully reproducible using open-source components and can be adopted or adapted by organizations seeking practical, AI-assisted IR capabilities.

With over 15 years of experience, Romulo Rocha is an Information Security leader specializing in building and scaling high-performance SOCs for mission-critical environments, including the Rio 2016 Olympic Games and Nubank. An expert in security automation, he focuses on evolving incident response beyond traditional SOAR using innovative architectures. His current research centers on evaluating Generative AI and autonomous agents within SOC pipelines to tackle alert fatigue and streamline complex triage. An active contributor to FIRST and the international security community, he is dedicated to sharing open, reproducible methodologies that advance the collective maturity of cyber defense.

Can a General Context LLM replace the intuition of a Tier 1 Analyst without expensive fine‑tuning? While vendors promise “AI‑driven SOCs,” this talk reveals the engineering reality of building an Autonomous Triage Agent from scratch using LangGraph, ChromaDB, and TheHive.

We present the design and execution of a controlled experiment: an agent tasked with identifying hidden threat campaigns buried inside a “Golden Dataset” of synthetic alerts. The session explores the architectural limitations of standard Vector Search — which often groups alerts by syntax rather than causality — and introduces “Agentic Pivoting,” a logic flow that allows the AI to autonomously investigate entities across time.

Attendees will leave with a blueprint for “Narrative‑Driven Triage,” a breakdown of the logic required to bridge the “Vector Gap,” some insights from an operational standpoint and applicability in real‑world scenarios, and the full source code to replicate the experiment.

Junya Hiwatari is a member of NTT-CERT and a GCFE holder. Since 2020, he has worked on digital forensics and incident response, as well as R&D on new attack detection technologies using machine learning. He is also a member of "The Institute of Digital Forensics" which promotes digital forensics in Japan. In the community, he supports collaboration among young members and contributes to developing technical documentation on cloud forensics for IaaS services, including GCP and AWS.

Yuta Kuwahara is a chief at NTT-CERT, leading the forensic team since 2025. His main expertise is in digital forensics and incident response. Previously, he worked at NTT-East, where he led projects on perimeter security and C2 server detection through network flow analysis. He also contributes to IT education in Japan by organizing the "ICT Troubleshooting Contest (ICTSC)" and actively participates in CTF competitions.

In digital forensics and incident response (DFIR), analysts must not only examine various artifacts but also trace their chronological relationships to understand the full scope of an incident. However, because of the complex interrelationships between artifacts, traditional manual analysis becomes increasingly time‑consuming.

To address this problem, we developed Attack Flow Finder (AFF) to automate and accelerate digital forensic investigations. AFF assists analysts by investigating and organizing artifacts according to user‑defined detection rules, called Ordered‑Sigma, which describe the intended sequence of events.

In this presentation, we will share the implementation ideas and use cases of AFF, focusing on:

1. designing “Ordered‑Sigma” rules;
2. implementing an algorithm to efficiently process chronological relationships;
3. comparison with existing tools;
4. analyzing endpoints infected with various cyber threats;
5. indicating response improvements through stakeholder use.

Through these points, we propose a new approach for accelerating digital forensics and discuss future challenges.

Eli Woodward is a Senior Threat Intelligence Advisor with 20+ years in law enforcement and private-sector security and a Master’s in Intelligence Studies. He helped build regional cyber intel reporting at Maricopa County and spent four years with Zelle. He is active in the Phoenix security community supporting CactusCon.

Cl0p’s 6‑year campaign of breaches has been the outcome of novel 0‑days and persistent campaigns, but they’ve been enabled by the way organizations architect data‑movement systems. For over half a decade now, Cl0p repeatedly targeted file‑transfer and middleware platforms that temporarily store the highest‑value organizational data in plaintext, operating as if these systems were Tier‑0 assets while defenders treated them as routine infrastructure utilities.

This session presents a timeline of major Cl0p campaigns (2019–2025) and demonstrates consistent patterns in malicious infrastructure, reconnaissance, exploit selection, and target choice. We then map these behaviors to underlying architectural flaws across commonly deployed MFT and middleware systems.

Attendees will leave with concrete design corrections—encrypting before ingestion, eliminating static staging folders, re‑classifying middleware as privilege boundaries, and building breach‑survivability into data‑movement workflows. This talk looks at structural fixes, not just IOCs, and offers practical guidance to reduce recurrence of MOVEit‑class events.

Aya Ohara works at LY Corporation, where she is involved in CSIRT operations and incident coordination. She has been an active member of the Nippon CSIRT Association since 2017 and contributes to strengthening national CSIRT collaboration through her work on the Regional Activities Committee.

She organizes regional workshops and online events to foster professional networking and peer learning across the community. Aya also serves as a trainer in CSIRT capacity-building programs, supporting organizational resilience and the development of future cybersecurity practitioners. Her professional interests include incident response coordination, communication within security teams, and building trusted relationships among CSIRTs.

Kaori Fukuda is a cybersecurity consultant specializing in CSIRT/PSIRT operations, factory security, and supply chain risk management. She has extensive experience in security governance, privacy protection, and regulatory compliance, and previously led IT operations and connected-car cybersecurity initiatives at a major automotive manufacturer.

Since 2020, Kaori has been with DNV Business Assurance Japan, where she helps organizations improve resilience and align with global cybersecurity standards. She also serves as a board member of the Nippon CSIRT Association and contributes to advancing cybersecurity maturity across the ecosystem through advisory, assessment, and training activities.

Ikuya Hayashi is the Steering Committee Chair of the Nippon CSIRT Association and a Senior Manager responsible for CSIRT operations at NTT Group (NTT-CERT). He has more than a decade of experience designing enterprise communication systems and over 15 years of academic and practical engagement in CSIRT architecture and operations.

He specialized in organizational theory at Meiji University’s Graduate School of Business Administration and in Business Engineering at Universiti Teknologi Malaysia. He has been actively promoting CSIRT adoption in Japan and has served as a Visiting Lecturer at Tokyo Denki University since 2015, focusing on cybersecurity workforce development. Ikuya is the author of the book CSIRT: From Planning to Operation and holds CISSP, SIM3 Auditor, and RISS certifications.

Modern cyber threats evolve faster than many CSIRTs can adapt, creating increasing pressure on limited teams to maintain resilience. This presentation introduces a five‑year initiative designed to build adaptive, scalable collaboration within Japan’s CSIRT community. Through 57 continuous sessions involving 508 organizations and 534 practitioners, the initiative generated curated evidence on how sustained, community‑driven interaction strengthens collective defense capabilities.

The findings reveal that the most valuable outcomes were not planned but emerged organically through monthly engagement. These include accelerated specialist development, reduced dependence on senior experts, and the formation of an “organic adaptive model” in which mutual learning and distributed support enhance both individual and organizational capacity. Simple academic models—combined with a strong focus on psychological safety—help explain why these mechanisms work and how they can be replicated.

The session will also provide practical tools that participants can implement immediately to strengthen adaptability and collaboration within their own CSIRTs. Ultimately, this work offers actionable guidance for organizations and communities seeking to climb toward their own summit of defense and build adaptive systems for modern threats.

Julie Agnes Sparks is a security engineer specializing in threat detection, threat hunting, and incident response with over 7 years defending organizations. She is currently working under Security Research at Datadog to develop novel detections and hunting opportunities on critical SaaS applications and cloud infrastructure. She was previously on Detection & Response teams at Brex and Cloudflare. In her spare time, she focuses on community building and mentorship for those in security operations.

Greg Foss is a seasoned cybersecurity leader with over 15 years of experience spanning threat research, security operations, and offensive security. As the Engineering Manager of Threat Detection Engineering at Datadog, he leads a team of elite threat hunters and detection engineers, developing cutting-edge defenses against sophisticated cloud-native intrusions by nation-state and criminally motivated adversaries.

What do you know about the visibility and threats in your critical SaaS applications? Come join us to learn about what you can see, what you’re missing, and the most common attack paths we are observing in the wild.

This technical deep‑dive talk will provide details on emerging SaaS attack trends across critical third‑party applications, such as case studies into Salesforce, GitHub, and GitLab attacks. Common behaviors include weak authentication methods, malicious or compromised third‑party applications, lateral movement within cloud infrastructure, and enumeration and exfiltration of critical data.

Leave this session with a guide on the next threat detections to develop and queries to use for threat hunts in your environment.

Peter Morin is a Senior Consultant specializing in OT/IoT cybersecurity, bringing over 25 years of industry experience to the table. With a robust background information technology and cybersecurity, Peter has become a trusted advisor to organizations navigating the complex and rapidly evolving landscape of operational technology security. His expertise encompasses the full spectrum of OT/IoT security, from risk assessment and vulnerability management to the design and implementation of comprehensive security frameworks to the deployment of OT passive monitoring solutions.

Peter has successfully led numerous high-profile projects across diverse sectors, including energy, manufacturing, and critical infrastructure, helping clients safeguard their systems against emerging threats. His hands-on experience in the field is complemented by a deep understanding of regulatory requirements and best practices, ensuring that his solutions are both effective and compliant.

In addition to his consulting work, Peter is a frequent speaker and educator, regularly presenting at industry conferences and contributing to leading cybersecurity publications. He holds multiple certifications, including CISSP, CISA, CGEIT, CRISC, CDPSE and GCFA, and is actively involved in professional organizations such as ISACA.Passionate about advancing the state of OT/IoT cybersecurity, Peter is dedicated to helping organizations build resilient systems that can withstand the challenges of today's dynamic threat environment.

This session explores how adaptive deception has evolved beyond static honeypots into a dynamic, intelligence‑driven layer of defense. Attendees will see how organizations are integrating canary assets across IT, OT, and cloud environments to generate precise telemetry, confuse attackers, and reduce mean‑time‑to‑detect from weeks to hours.

Real‑world case studies and live demonstrations will illustrate how deception can be safely automated, measured, and scaled as part of a mature detection and response strategy.

Mathias Persson is a cybersecurity specialist at CERT-SE, Sweden’s national Computer Security Incident Response Team. Passionate about collaboration and practical solutions, Mathias works closely with municipalities, regions, and national stakeholders to strenghten resilience against evolving threats. In this session, Mathias shares real-world insights from a year-long battle against persistent phishing campaigns and the lessons learned from building effective partnerships.

Between June 2024 and May 2025, CERT‑SE observed an alarming surge in phishing attacks aimed at Swedish municipalities, regions, and schools. These campaigns were not only widespread but highly persistent, exploiting compromised M365 accounts to spread malicious emails internally and externally. The impact included reputational damage and, in some cases, financial fraud, as well as an increased risk of data breaches.

In this presentation, we will share how CERT‑SE analyzed these attacks, uncovering common patterns and tactics used by threat actors. More importantly, we will tell the story of how collaboration became the key to an effective response. By partnering with SKR (Swedish Association of Local Authorities and Regions), we developed and distributed a practical guide for handling compromised accounts in M365 environments. This initiative helped organizations regain control and implement proper remediation steps.

Attendees will gain insight into the anatomy of these phishing campaigns, lessons learned from large‑scale incident coordination, and actionable recommendations for improving resilience in similar environments.

SNEHA RANGARI received the M.S. degree in Cybersecurity from the University of North Carolina at Charlotte, Charlotte, NC, USA, in 2019. Since July 2019, she has been with Visa, where she initially joined as a fresh graduate Cybersecurity Engineer. In this role, she worked with the Security Engineering team, focusing on Perimeter Engineering tools, including Web Application Firewalls (WAFs) and traditional Firewalls. She currently serves on the Security Architecture team. Her current work focuses on projects related to the strategic use of Generative AI in security, the application of advanced machine learning and deep learning techniques to counter sophisticated adversarial models and primarily focused on strengthening Visa's front-end payment security posture. She holds the prestigious certifications of Certified Information Systems Security Professional (CISSP) and SANS GIAC Machine Learning Engineer (GMLE). She is also an active mentor and a frequent speaker on cybersecurity topics at various industry conferences.

GPUs power the AI revolution and silently harbor the next wave of cyber threats. From data centers to cloud AI workloads, attackers are exploiting GPU memory, kernels, and interconnects in ways traditional security tools cannot detect.

As AI reshapes industries, Graphics Processing Units (GPUs) have become indispensable engines, accelerating everything from neural network training to high‑performance inference. Yet this reliance has created a new, largely invisible attack surface. Adversaries are leveraging this gap to deploy VRAM‑resident malware (Jellyfish), perform GPU snooping, launch side‑channel attacks, hijack GPUs for cryptocurrency mining, and even steal proprietary AI models — all while evading conventional defenses.

This session draws on primary research, case studies, and hands‑on demonstrations to illustrate how GPU threats compromise AI confidentiality, integrity, and reliability. Attendees will gain actionable techniques for GPU telemetry monitoring, VRAM forensics, and integrating GPU visibility into SOC workflows.

The talk also empowers participants to take ownership of GPU security in their own environments, exploring research, defense strategies, and leadership opportunities in hardware‑aware AI protection. By the end, participants will understand why securing GPUs is critical to securing the future of AI — and how to illuminate the dark silicon powering intelligent systems worldwide.

Sven Rath works as a Security Researcher at Check Point Research, spending most of his time hunting for emerging malware threats and reverse engineering different malware, from malicious Browser Extensions to Kernel Level Rootkits. After work, he spends his time researching Windows Kernel Internals and fringe malware techniques and writing blog posts about both.

Node.js has become a staple in the malware development toolkit of crimeware authors: it is easy to develop, trivial to obfuscate, and difficult to analyze — with a wide array of open‑source obfuscators, originally designed to protect intellectual property, commonly abused by threat actors to hide their malicious code.

This talk introduces a purpose‑built Node.js Tracer designed to cut through the noise by instrumenting the runtime rather than having to deal with tedious manual source‑code deobfuscation, ultimately saving precious time for analysts and incident responders. After an overview of different forms of Node.js malware observable in the wild, the talk reconstructs a malware research effort that sparked the tool’s development, outlines the mechanics of tracing as a dynamic reverse‑engineering method, and demonstrates how runtime hooking exposes the malware’s real behavior.

Attendees will see, using case studies of several real incidents, how the utility neutralizes anti‑analysis checks, bypasses obfuscation, and speeds up the analysis process — resulting in a practical workflow for incident response teams facing increasingly obfuscated JavaScript‑based malware families.

Eli Woodward is a Senior Threat Intelligence Advisor with 20+ years in law enforcement and private-sector security and a Master’s in Intelligence Studies. He helped build regional cyber intel reporting at Maricopa County and spent four years with Zelle. He is active in the Phoenix security community supporting CactusCon.

Organizations routinely rely on annual IR and threat‑intelligence reports to guide strategy and prioritize security investments. Yet across the industry, these reports frequently contradict one another on the top intrusion vectors, dominant attacker behaviors, and definitions of common categories such as credential misuse. These contradictions do not reflect attacker volatility; they stem from structural bias in each vendor’s data‑collection pipeline.

This session presents an empirical comparison of major public IR/TI reports, shows how intake pathways and telemetry footprints shape what each vendor “sees,” and offers a practical framework for interpreting vendor reports as partial lenses rather than authoritative truth. Attendees will learn how to normalize conflicting data, reduce mis‑prioritization in their IR programs, and push for shared taxonomies that improve collective situational awareness.

Adam Messer is a security engineer with 6+ years of experience in detection engineering, incident response, and cloud security on both government and private systems. He is currently a Senior Security Engineer at Datadog on the Detection Engineering and Threat Hunting team. In his free time, he hikes and rock climbs in the Rocky Mountains.

North Korean threat actors are increasingly infiltrating global hiring pipelines by posing as legitimate software developers and security engineers. In this session, we’ll break down what these synthetic applicants look like in practice, the visibility gaps most organizations don’t realize they have, how their tradecraft has evolved, and the system you need to detect them.

This talk will cover how we built a detection stack for identifying and blocking fake applicants, including the use of behavioral and IOC‑based detections, cross‑system enrichment for correlation, and AI‑driven risk assessment. Our team has utilized this system to collect intelligence from these synthetic personas and convert it into actionable indicators.

At the end, we will dive into our metrics and tangible insights from 9 months of detecting and tracking fake applicants. By covering common IOCs, infrastructure fingerprints, recurring resume features, and operational patterns, you can launch a threat hunt within your own recruiting funnel.

Attendees will leave this session with practical detection strategies and a roadmap for building talent‑security visibility.

Trey Darley leads the FIRST Time Security SIG, coordinating international research and remediation efforts related to the 2036–2038 rollover vulnerabilities. He has spent the past decade studying temporal fragility across embedded, cloud, and critical-infrastructure systems, and recently presented the draft technical report for this work at the ITU-T.

A long-standing member of the BruCON and FIRST communities, Trey has served in multiple volunteer roles, including a term on the FIRST Board of Directors, where he co-founded the FIRST Standards Committee. He is recognized for his contributions to open cybersecurity standards such as STIX/TAXII, and for his long association with the Langsec community’s approach to software correctness and input handling. Trey’s patron saints are Grace Hopper, Evi Nemeth, and Paul Erdős. Trey has presented at USENIX, FIRST, BruCON, O'Reilly Security Amsterdam, RSAC, hack.lu, BSides Lisbon, and others.

Pedro Umbelino currently holds the position of Principal Research Scientist at Bitsight Technologies and brings over a decade of experience in dedicated security research. ⁤His eclectic curiosity has led to the uncovering of vulnerabilities spanning a gamut of technologies, highlighting critical issues in multiple devices and software, ranging from your everyday smartphone to household smart vacuums, from the intricacies of HTTP servers to the nuances of NFC radio frequencies, from vehicle GPS trackers to protocol-level denial of service attacks. Pedro is committed to advancing cybersecurity knowledge and has shared his findings at prominent conferences, including Bsides Lisbon, DEF CON, Hack.lu and RSA.

The 2036–2038 rollover is not a legacy timestamp bug. It is a cross‑sector vulnerability class and a global systemic risk, rooted in a pervasive design pattern inherited from the original 32‑bit Unix time_t representation. Modern dependency chains amplify this exposure through orphaned firmware, unmaintained toolchains, libraries, userland components, certificate‑validity windows, distributed authentication flows, and other long‑tail software lifecycle failures.

Many production environments cannot be safely tested without emulating upstream Internet dependencies — the same observer‑effect challenge that malware analysts face when studying complex malware behavior in isolated sandboxes.

This talk introduces a temporal‑stress testing framework for CERTs, PSIRTs, and IR teams, along with cross‑sector dependency models, early‑warning indicators, communication templates, and priority mitigations. Drawing on a decade of analysis across embedded, automotive, telecom, cloud, and critical‑infrastructure domains — including over a year of intensive research mapping how these dependencies interact — we offer a practical, repeatable approach organizations can begin implementing now, before correlated failures begin to cascade into predictable crises that will otherwise appear as Black Swan events in retrospective postmortems.

Is this your first FIRST? Join us for a quick introductory session and meet other FIRST newbies and the FIRST staff.

Saimir Kapllani is a senior cybersecurity official with over 15 years of experience in securing national critical information infrastructures and developing resilient cyber governance frameworks in Albania. As Director of Cybersecurity Governance, Risk, and Compliance at the National Cybersecurity Authority, he has led the design and implementation of policies, standards, and regulatory mechanisms that ensure the security, resilience, and operational continuity of critical sectors.

Mr. Kapllani has overseen the establishment of a national cybersecurity risk management program, the implementation of compliance and audit frameworks aligned with international standards (NIST, ISO 27001, COBIT, ENISA guidelines), and capacity-building initiatives targeting public and private operators of essential services. He also serves as Albania’s national technical point of contact with the OSCE on Confidence Building Measures and actively contributes to regional efforts on cyber maturity, CERT development, and cyber hygiene. His expertise lies in building scalable, trusted, and adaptive cybersecurity governance models that reinforce national resilience and align with EU and NATO frameworks.

In 2022, Albania faced one of the most disruptive nation‑state cyberattacks in its history, resulting in critical infrastructure downtime and unprecedented public exposure. Rather than retreat, the country responded with swift, coordinated reforms that reshaped its entire cybersecurity governance landscape. This session explores Albania’s transformation from being the target of a cyber breach to becoming a regional benchmark for resilience and governance.

Through this case study, we will examine the steps taken post‑attack: the restructuring of national cyber response mechanisms, capacity‑building within public institutions, implementation of international frameworks, and the elevation of CSIRT capabilities. The presentation will highlight lessons learned, challenges encountered, and the strategies that enabled Albania to turn crisis into opportunity — offering practical insights for nations and organizations seeking to enhance their cyber resilience.

Attendees will gain a first‑hand look at how adversity catalyzed long‑term security improvements and how a small country emerged as a role model in cybersecurity governance.

Mor is a Staff Software Engineer specializing in analyzing cloud-native security and supply chain threats. His efforts have uncovered a variety of emerging threats, including unsecured environments and platforms, as well as cryptomining campaigns. Additionally, he has collaborated with the Center for Internet Security (CIS) to develop guidelines for software supply chains and an open-source security tool to address these challenges.

We analyzed CVE remediation patterns across 10,000 open‑source projects to understand a critical problem: the mean time to repair (MTTR) for vulnerabilities as they propagate through the ecosystem. Our research reveals a sobering reality — CVEs fixed upstream take weeks or months to reach downstream containers, creating massive security‑exposure windows in Kubernetes environments.

In this talk, we'll present our findings showing how CVE fixes flow (or stall) through different ecosystem layers — from upstream projects to package managers to base images to final containers. You'll see real data on remediation delays, bottlenecks, and the compounding effect of layered dependencies.

But we won't stop at the problem. The second half focuses on practical solutions. We'll demonstrate remediation strategies that actually work at scale, from automated patch backporting to in‑place image patching with tools like Copa. You'll learn how to build workflows that dramatically reduce MTTR, including dependency‑automation patterns and risk‑based prioritization.

Attendees will leave with both a data‑driven understanding of the CVE remediation challenge and a practical playbook for fixing it, complete with automation templates and proven patterns from the field.

The presenters serves as a Lead Security Architect and Director of Security Operator leading hybrid-cloud and AI-augmented incident-response initiatives for a large U.S. healthcare insurer. His work spans log normalization, SOC automation, AI governance, and evidence reliability frameworks. He has designed log-to-timeline pipelines aligned to OCSF and has published on AI governance, bias mitigation, and forensically sound automation in security operations.

above

Hybrid‑cloud infrastructures generate fragmented evidence trails across AWS, Azure, SaaS, and endpoint telemetry, which slows investigations when every second matters. This session introduces an AI‑assisted, schema‑driven incident‑response pipeline that automatically normalizes any log source to the latest Open Cybersecurity Schema Framework (OCSF), enforces UTC timestamping, and produces a defensible, time‑ordered narrative like outputs from log2timeline/plaso but optimized for operational SOC use.

Unlike ad‑hoc scripts, this framework embeds Daubert, Frye, and Durant evidentiary‑reliability criteria, ensuring that all AI‑assisted transformations remain transparent, auditable, and admissible in regulatory or legal contexts. Each step is version‑controlled, hash‑verified, and explainable, providing both analytical speed and forensic integrity.

Attendees will see reference architectures deployable in Splunk, Sentinel, or Databricks Lakehouse environments, learn how to integrate large‑language models (LLMs) for field inference and semantic clustering safely, and receive reproducible templates for audit‑ready timeline generation. The presentation closes by mapping the architecture to NIST IR, MITRE ATT&CK, and NIST AI RMF controls, offering a practical blueprint for building adaptive, legally defensible incident‑response pipelines in the age of hybrid cloud and AI.

Antonis Terefos is a malware reverse engineer at Check Point Research with experience in the cyber threat landscape. He specializes in dissecting and analyzing malicious software to uncover hidden threats within the ever-evolving cyber threat landscape. In addition to his professional work, Antonis enjoys testing malware command-and-control (C2) infrastructures in his spare time. By exploring these C2 systems, he gains valuable insights into the strategies and tactics employed by threat actors, enriching his overall understanding of the adversarial landscape.

A new era of malware distribution has emerged. Hackers no longer need to approach their victims directly — they only need to attract them. This new method of spreading malware is enabled by Ghost Networks, which operate across popular platforms. A Ghost Network is a collection of fake or “ghost” accounts that function as a coordinated service, manipulating platform‑engagement tools to disguise malicious activity as legitimate and enable large‑scale malware distribution.

These networks have grown in popularity due to their efficiency in infecting large numbers of victims in a short time while remaining undetected, as their account activities appear benign to the platforms on which they operate. They achieve this by operating across popular platforms, including GitHub, YouTube, X, Discord, SourceForge, and Twitch, using fake accounts to manipulate engagement tools on each platform.

Alan Turing, in his seminal 1950 paper, introduced the concept of “The Imitation Game.” In this “game,” a machine’s goal is to imitate a human so convincingly that an interrogator cannot reliably distinguish between the machine and a human participant. Nearly 75 years later, Turing’s ideas remain relevant, as Ghost Networks now play a similar “Imitation Game,” using AI (LLMs) to mimic human behavior and infect unsuspecting users with malware.

Tien-Chih Lin (aka Dange) is the research team lead at CyCraft Technology, specializing in machine learning, red teaming, vehicle security, and cloud security. Alongside his technical expertise in offensive security, he has significant experience in cybersecurity management and holds a CACSP certification. His research and work have been presented at conferences including Black Hat USA/Europe, HITCON CMT/ENT, USENIX Security, CYBERSEC, MOPCON, and ECCWS. Beyond research, Tien-Chih has delivered training at events such as AIS3, HITCON Training, and NICS. He is also one of the creators behind the educational cybersecurity board games "Cybercans" and "Cybercrete."

Wei-Chia Kao is a Project Manager at CyCraft Japan Corporation and a board member of the Association of Hackers In Taiwan (HIT). She holds a B.S. in Computer Science from National Taiwan University of Science and Technology and an MBA from Hosei University in Japan. With professional experience across AI, indie games, and cybersecurity, she brings a unique cross-disciplinary perspective to her work. Active in the cybersecurity community for years, she served as the vice coordinator of HITCON Community 2016, Taiwan’s most representative cybersecurity conferences. She is the producer of two cybersecurity-themed educational board games, Cybercans and Cybercrete, with Cybercans has been experienced by thousands of security professionals, business leaders, students, and educators from Taiwan, Japan, and the United States. She has also spoken at AVTokyo, HITCON, TGDF, and other cybersecurity / game development conferences. Believing that education has the power to change the world, Wei-Chia is passionate about making cybersecurity more accessible and engaging. Drawing on her diverse background, she transforms complex technical knowledge into intuitive and interactive formats. She is dedicated to inspiring future cybersecurity talent and raising public awareness to strengthen cyber defense.

Yi-Hsien Chen earned his B.S. degree in Computer Science at National Chiao Tung University (NCTU) and is currently a Ph.D. candidate in the Department of Electrical Engineering at National Taiwan University (NTU), a research assistant in the Department of Computer Science at National Yang Ming Chiao Tung University (NYCU), and a security researcher for the CyCraft research team. His research focuses on automatic malware analysis techniques, cyber threat intelligence, machine learning, and various cybersecurity topics. His work has been published in IEEE TIFS, DSC, ACM ASIACCS, and CCSW. He has also spoken at HITB CyberWeek, AVTokyo, HITCON, SECCON, and CODE BLUE. Additionally, he was a member of the BambooFox CTF team from NYCU, has participated in several CTFs, and has won 12th and 2nd place in DEFCON 26 and 27, respectively, with BFS and BFKinesiS CTF teams.

Even organizations with robust cyber budgets and advanced tools often struggle during real incidents — not due to technical gaps, but because boards and operators lack shared mental models of risk and trade‑offs. Traditional briefings fail to close this divide; they are consumed passively and forgotten quickly.

We propose a radical alternative: encode critical cybersecurity concepts (CDM, CTEM) into game‑based simulations, where decision‑makers experience failures, resource constraints, and coordination friction firsthand. Through visceral, compressed feedback loops, participants build durable intuitions that PPTs cannot deliver. Validated across 1,000+ participants in multiple regions, this approach accelerates organizational learning and cross‑role alignment by months.

This talk shares how to leverage the learning science in simulation‑based encoding, demonstrates how it transforms abstract frameworks into embodied knowledge, and provides a concrete blueprint for building adaptive defense through experiential practice — not more lectures.

Andréanne Bergeron, PhD, is a researcher at Flare, specializing in online attackers’ behaviors. Her expertise delves into the intersection of criminology and cybersecurity. In addition, Andréanne holds an esteemed position as an affiliated professor in the Department of Criminology of Montreal University, bridging academia and industry. Her commitment to provide a unique perspective on the human element behind digital threats reflects a holistic approach, enriched by theoretical depth and real-world applicability. Andréanne has showcased her research at prestigious conferences such as BlackHat USA, Defcon, CypherCon, and ShmooCon. Active in her community, Andréanne serves as Vice President in NorthSec organizing team.

Cybersecurity executives still treat “exposure” as a single number, then want to know their one risk score, even though attackers haven’t operated in a single dimension for over a decade. It is now very easy for threat actors to automate large‑scale, hyper‑targeted phishing campaigns using full‑spectrum, graph‑like profiles of organizations and individuals, blending leaked credentials, personal identifiers, behavioral signals, financial data, corporate access paths, and vulnerable assets to create multi‑vector entity‑exploitation opportunities.

In this talk, we introduce a new four‑branch Identity Exposure Metric that redefines how defenders measure vulnerability in a world where password leaks are only one piece of the attack surface. Drawing from 216B+ compromised records and deep empirical modeling, we show how identity reconstruction, authentication leakage, financial sensitivity, and social‑engineering susceptibility each contribute to different pathways of harm.

Attendees will learn how the Identity Exposure Metric can prioritize real‑world risk, help detection engineers and threat hunters spot AI‑based phishing, and reinforce identity‑centric defense strategies. This session challenges existing assumptions and presents a new blueprint for measuring digital exposure.

Brian John DeWyngaert Jr. is the Senior Technical Advisor for Threat Hunting at the Cybersecurity and Infrastructure Security Agency (CISA), bringing over 20 years of experience across the U.S. Military, U.S. Federal Executive, and private sectors. A strategic thought leader for CISA since 2009, Brian has held pivotal leadership roles including leading coordinated defensive operations for CISA and Deputy Officer in Charge for a U.S. Military Operations Team. His expertise lies in bridging the gap between executive strategy and technical engineering.

Threat intelligence is only as valuable as an analyst’s ability to translate human insight into machine‑readable data — yet most indicators still circulate in ad‑hoc emails and chat threads, bypassing STIX/TAXII pipelines and slowing collective defense.

This session unveils CISA’s Indicator Message eXchange (IMX), a newly open‑sourced, containerized platform that lets experts publish high‑fidelity STIX 2.x packages in minutes — no schema expertise required. Attendees will see live demos of IMX’s dual interface: a Guided Mode that walks any analyst through five intuitive questions (Who, What, Where, How, Why) and an Expert Mode with real‑time validation and enrichment hooks.

Naoki Takayama is a security researcher at Internet Initiative Japan, Inc. As a member of IIJ-SECT, the private CSIRT of his company, he is engaged in threat research and incident response. His research focuses on malware and tactics used in targeted attacks. He has spoken at BSides Tokyo and VB in the past.

Cobalt Strike remains one of the most widely abused post‑exploitation frameworks, favored by both cybercrime groups and state‑sponsored APT actors. In recent years, defenders have significantly improved their tooling and techniques for detecting and analyzing the Cobalt Strike Beacon. As a response to this, some threat actors have shifted toward reimplementation of the Cobalt Strike Beacon written in modern programming languages such as Rust and Go. These new variants offer improved stealth, flexible customization, and inherent evasive characteristics originating from their language ecosystems.

This talk will present an in‑depth analysis of these emerging variants, exploring their architecture, behaviors, and notable samples observed in the wild. Additionally, we will offer practical strategies for blue teams, including configuration‑extraction methods and YARA detection rules designed to identify these new threats.

Teeing up lessons learned from eight years as the NSA Deputy Director and Chief Operating Officer and his service as the nation's first National Cyber Director, Chris Inglis will address the why, what and how of effective cyber defense.  Defining these essential components correctly will mobilize more resources, employ them with greater effect, and better achieve the intended outcome - ensuring the cyberspace meets the expectations of people and organization dependent on them for life and business critical services.

Aaron Walton is a Threat Intel Analyst at Expel, responsible for monitoring, tracking, and analyzing trends to help customers disrupt their adversaries. He’s an accomplished malware and threat researcher, frequently contributing to cybersecurity publications and conferences. His interactions with the cyber world are shaped by a lifetime of exposure to other disciplines, such as aviation regulation, compliance, cultural and linguistic anthropology, ethnomusicology, social justice, and world religion. As a career changer, Aaron brings this diverse skillset to his work to share information that aims to equip others in studying, hunting, and foiling bad actors. When he's not at a computer, he is often playing Irish flute in a local pub.

Code‑signing certificates are meant to indicate that a software application is issued by a trusted party and hasn’t been modified. But what about when attackers have the keys to sign?

Based heavily on original research, this talk discusses the problem of malicious code‑signing certificates: we will examine the means attackers use to obtain certificates, who is doing it, what malware families are being signed, and the trends over time.

Defenders can use these same code‑signing certificates to their advantage. We’ll explore how defenders can identify suspicious certificates, the revocation process and value of revocation, and highlight the additional research and detection opportunities that allow defenders to flip‑the‑script and make code‑signing a liability for threat actors rather than an asset.

Marko Krstić completed his bachelor, master, and doctoral studies at the School of Electrical Engineering in Belgrade. His topic of doctoral thesis was related to application of AI in recommender systems. He has been working in the field of information technology and security at the Regulatory Authority for Electronic Communications and Postal Services (RATEL) for almost ten years. He is currently serving as the Head of the Cyber Security Division and National CERT Affairs in the RATEL. Marko was part of several projects related to the application of artificial intelligence for children protection on the Internet as well as for digital forensics at the European level.

MISP‑GPT introduces a fully open‑source approach to integrating Large‑Language Models (LLMs) with the Malware Information Sharing Platform (MISP), without relying on proprietary tools such as Claude Desktop. Built on Ollama, an open‑source platform, and compatible with community MCP (Model Communication Protocol)‑based integrations, MISP‑GPT enables analysts to query, retrieve, and summarize threat‑intelligence data directly from MISP using natural‑language prompts.

The system can also structure and input new threat‑intel data into MISP, accelerating IOC ingestion and reducing manual overhead. This talk will demonstrate how MISP‑GPT works, compare it with existing MISP‑MCP‑SERVER and misp‑mcp implementations, and show how teams can deploy a secure, local LLM workflow for CTI operations. Attendees will leave with actionable guidance, sample architectures, and practical steps to build their own open‑source LLM‑powered threat‑intel assistant.

Olivia Brown is a cyber threat intelligence analyst at Socket. Previously, she has worked for the US State Department and the US Defense Department in roles focused on cybersecurity. She has a Master's in Strategy, Cybersecurity, and Intelligence from the Johns Hopkins School of Advanced International Studies. She also attended Johns Hopkins for her undergraduate degree, where she double majored in Computer Science and International Studies.

On August 26, 2025, nx npm packages were compromised in a supply‑chain attack. It was one of the first documented supply‑chain attacks to weaponize Claude, Gemini, and Q Command‑Line‑Interface (CLI) developer tools. The malware stole GitHub tokens, npm credentials, SSH keys, and cryptocurrency wallets from thousands of developer systems within hours, and exfiltrated the data to over 1,000 attacker‑controlled repositories in victim accounts.

Other novel aspects of the campaign include LLM‑powered reconnaissance, triple‑base64 encoding, and a denial‑of‑service persistence mechanism. This 30‑minute presentation thoroughly explains this attack, how we found it, and what the malware script did. Attendees will learn how to detect AI‑assisted malware in their supply chains, implement defensive scanning strategies, and understand emerging attack vectors that weaponize the very AI tools designed to help developers.

Seulgi Lee is a malware analyst at KrCERT/CC, where he conducts threat hunting on attacks targeting Korea, and shares insights to help prevent incidents and minimize their impact.

Chanwoong Hwang is a malware analyst at KrCERT/CC, where he specializes in analyzing malware targeting South Korea and focuses on developing AI-driven malware analysis workflows.

KrCERT/CC presents a study using data from a Korean free DNS provider that has been abused by multiple threat actors, including groups such as Kimsuky and Andariel, since 2016. By accessing account, domain, DNS, and login‑log data, KrCERT/CC analyzed how attackers created and maintained their infrastructure before launching attacks.

We automated pivots from malicious domains to the accounts that created them and then to additional domains registered by those accounts, profiling and clustering the accounts using connected IPs, passwords, and naming themes to refine attribution of threat actors and uncover relationships between groups.

This study analyzes threat‑actor behavior in managing their infrastructure across the domain lifecycle and their operational management tasks, and proposes several implications, including the operational and legal limits of malicious‑domain takedown and the need for collaboration and improved policy to regain the initiative from attackers.

Dr. Yang Cheng-Lin, the data science director at CyCraft Technology, holds a PhD in Artificial Intelligence from the University of Edinburgh. His focus is on security issues in AI applications. His notable work has been featured at prestigious academic conferences like EMNLP and NeurIPS, and his expertise has been showcased at various cybersecurity conferences, including the FIRST CTI Summit, Black Hat USA, Code Blue Japan, HITCon Enterprise, and SINCON.

Yen-Shan (Lily) Chen is a data scientist at CyCraft Technology, where she currently focuses on research into potential vulnerabilities in Retrieval-Augmented Generation (RAG) frameworks and developing methods to evaluate them. Lily has previously presented at major cybersecurity conferences such as Code Blue Japan and SINCON, and she also published her work at the renowned ACL conference. 

As SOCs, CSIRTs, and incident‑response teams adopt LLM and RAG systems for alert triage, investigation, and automation, they introduce a new attack surface: data‑level manipulation in the artifacts these systems ingest. This session shows how a single attacker‑crafted item — such as a phishing email, chat transcript, incident note, or external report — can be formatted so that retrieval baits are consistently surfaced by embedding models and malicious instructions are attended to by generative LLMs. Rather than exploiting model internals, attackers simply shape document structure to steer what the system retrieves and what it outputs.

We will walk through a live, end‑to‑end demonstration of how such an artifact biases retrieval, influences generation, and ultimately alters the analyst‑facing narrative of an investigation. The session concludes with practical, low‑cost defenses that SOCs and CSIRTs can deploy immediately to harden AI‑augmented workflows and detect adversarial influence before it reaches decision‑makers.

John Fokker is the Vice-President Threat Intelligence Strategy at Trellix, where he and his team drive a cross-functional mission to detect, understand, and disrupt cyber adversaries—delivering intelligence-led outcomes for customers, products, and global partners. Prior to joining Trellix, he served with the Dutch National High-Tech Crime Unit (NHTCU), the Dutch National Police unit dedicated to investigating advanced forms of cybercrime. Over the course of his career, he has supervised numerous large-scale cybercrime investigations and takedowns. Fokker is also a co-founder of the NoMoreRansom Project and a member of the Europol EC3 advisory group on Internet Security.

Mo Cashman is one of Trellix’s senior leaders in cyber security. Mo’s passion is to inspire our next generation security leaders, build impactful teams and programs, and help customers architect security solutions for future resilience. As a Field CTO at Trellix, Mo advises our largest global customers and partners on their cyber threat management, security operations and zero trust strategies. With that passion and 25 years of experience, Mo also leads Solutions Engineering teams, global technical and customer programs, and advises Trellix senior leaders on future product strategy. In previous roles at McAfee and Intel, Mo was the Chief Technical Strategist for the Global Government program and just prior to joining the company, lead Computer Emergency Response Teams doe Defense customers investigating and responding to sophisticated cyber threats.

Modern defenders are drowning in indicators but starving for context. Most CTI sharing still relies on loose IoCs and unstructured notes that are impossible to operationalize at scale — let alone feed into AI systems. This talk presents a practical, open approach to transforming MISP from an indicator repository into a structured, AI‑ready threat‑intelligence backbone.

We show how to model threat actors, tools, campaigns, and TTPs using MISP objects, galaxies, and relationships to create a consistent, machine‑readable knowledge layer. This framework enables automated enrichment, faster correlation, and more reliable detection engineering by shifting the focus from isolated indicators to behavioral intelligence.

As part of the session, we release our public GitHub repository containing reusable actor and tool models so teams can immediately adopt — and contribute to — the same structured approach. The talk ends with a call to action: if we want scalable, AI‑assisted incident response, we must standardize how we model threats. MISP gives us the foundation; the community provides the momentum.

Tod Eberle is the Alliance Director at The Shadowserver Foundation, a nonprofit cybersecurity organization. Shadowserver collects cyber threat data at Internet-scale and distributes free daily network remediation reports to help 10,000+ organizations and National CSIRTs covering 175 countries secure their networks. Shadowserver also provides free support to many of the world’s most significant international Law Enforcement cybercrime disruption operations. Tod leads Shadowserver’s Alliance Partnership, a community of like-minded organizations that support Shadowserver’s nonprofit mission and work collaboratively to share information and address the latest cyber threats.

Prior to joining Shadowserver in 2023, Tod served for 19 years as a U.S. Department of Justice prosecutor where he specialized in investigating, prosecuting, and disrupting cybercrime activities committed by organized criminal groups and nation-state threat actors.

The panel will examine the operational means and challenges in each stage of the data‑sharing pipeline of the victim‑notification process associated with international law‑enforcement cybercrime takedowns and disruption operations. The panelists will include a federal law‑enforcement officer, a representative of the Shadowserver Foundation, and a representative of a National CSIRT, who each will provide their unique perspectives on the victim‑notification process from start to finish.

The discussion will include their respective roles in the data‑sharing pipeline; the current framework in place for sharing victim data on a global scale; the various operational means by which each entity shares data with third parties; limitations on data sharing due to legal, technical, and jurisdictional factors; overcoming challenges that arise in the process; and the impact of Early Warning Services and similar mechanisms by which National CSIRTs can most effectively share victim data with ISPs and help make notifications to end‑user victims.

With over 15 years of experience in cyber and physical security, Zach Nelson currently serves as the Vice President of Health-ISAC's Threat Operations Center. He leads and mentors a global Threat Operations Center (TOC) responsible for producing and disseminating actionable cyber, strategic, and physical threat intelligence. Zach's leadership is instrumental in assisting Health-ISAC members in reducing their attack surface and significantly enhancing their security defenses. Furthermore, as the Health-ISAC liaison, he spearheads collaboration and innovation across the Cyber Threat Intelligence Program Development, Insider Threat, and Business Information Security Officer (BISO) working groups. His efforts drive these vital intelligence initiatives' ongoing refinement and success to support Health-ISAC membership. Zach holds a Master of Science in Cybersecurity and various certifications in cybersecurity, cyber threat intelligence, security operations, and incident response.

Ethan Muntz is a Strategic Threat Analyst at Health-ISAC. Combining interest in cybersecurity issues with international experience and intensive cybersecurity studies, Ethan aspires to bring unbiased trend analysis to the Health-ISAC membership. Ethan has spearheaded many strategic initiatives, such as joint research with members, a biweekly geopolitical newsletter, and monthly deep-dive reports into influential policy. Ethan also acts as the Health-ISAC liaison in joint research into the developing security risks facing healthcare, such as AI model poisoning and large-scale social engineering. Finally, Ethan facilitates two working groups at Health-ISAC, the Artificial Intelligence Working Group and the Regional Tensions Working Group.

Join us for an engaging session that shares key findings from the 2025 Annual Threat Report, with a specific focus on the maturation of ransomware campaigns and the evolving tactics of cybercriminal operations targeting critical health‑sector infrastructure.

The session will include insights into recent operations that successfully disrupted phishing and adversary tooling infrastructure. The session will also include insights from targeted alerts, demonstrating the value of proactive intelligence sharing in reducing vulnerabilities and maintaining business resilience.

We will close the session by highlighting the role of ISAC collaboration for coordinating defenses against complex supply‑chain risks. Participants will receive actionable strategies for implementing targeted intelligence and collective defense measures.

Hiroaki Toyota is an AI Researcher at LAC Co., Ltd., specializing in Agentic AI and AI Safety within the cybersecurity domain. He leads research and development efforts to enhance security operations through AI automation and ensures the safe implementation of AI systems. Mr. Toyota possesses extensive knowledge of AI mechanisms, having previously served in R&D roles focused on machine learning and deep learning algorithms at an AI startup. He recently presented his high-impact research on Agentic AI for Offensive Security at the prestigious CODE BLUE 2025 (Tokyo, Japan), delivered in English, highlighting his expertise in solving complex, practical security challenges.

Traditional defense models may soon face a formidable challenger: Self‑Modifying Agentic Malware, LLM‑guided code that continuously rewrites itself in response to local conditions, aiming to sidestep Endpoint Detection and Response (EDR). This talk presents a safe, containerized adversary‑emulation rig that demonstrates the observe–plan–act loop and showcases likely ATT&CK‑aligned techniques, from file‑less memory residence and process injection to polymorphic payloads and covert cloud‑based C2.

We then outline a Proactive EDR strategy built on five pillars, prominently featuring AI‑driven Intent‑Centric Correlation alongside sensor‑integrity checks, dynamic deception assets, moving‑target hardening, and risk‑based automated containment. Replayable telemetry, sample detection rules, and concise playbooks will be shared, enabling participants to reinforce their SOCs quickly with tool‑neutral methods and AI‑assisted analytics before this adaptive threat moves from laboratory proof‑of‑concept to real‑world incidents.

For the past decade, I’ve worked with SOC teams of all sizes to help them detect, investigate, and respond to modern threats. My primary focus is the Microsoft identity stack (Entra ID and the full suite of on-premises Active Directory technologies). I specialize in understanding attacker tradecraft and translating it into practical detection strategies for defenders. When I’m not helping my customers with their cyber fires, I’m creating and teaching technical workshops and helping large organizations deploy Zero Trust architecture.

This session focuses on what AiTM activity looks like inside Entra ID: the key authentication events, token behaviors, and anomalies attackers leave behind. We then cover how to surface and interpret these signals, using KQL only as an example to navigate telemetry (especially since Entra ID logs are often unclear or incomplete).

Attendees leave with a clear takeaway: practical patterns, investigative cues, and a short list of effective mitigations to quickly detect and block AiTM techniques in real environments.

Kuan-Lun Liao is a data scientist at CyCraft Technology responsible for applying various NLP techniques to solve cybersecurity issues, focusing on AI system compliance testing and automated threat intelligence integration. He was a speaker at FIRST CTI, CYBERSEC, and SECCON. His work has been published in ICML, ICLR, and AAAI, three of the world's leading machine learning conferences.

Dr. Yang Cheng-Lin, the data science director at CyCraft Technology, holds a PhD in Artificial Intelligence from the University of Edinburgh. His focus is on security issues in AI applications. His notable work has been featured at prestigious academic conferences like EMNLP and NeurIPS, and his expertise has been showcased at various cybersecurity conferences, including the FIRST CTI Summit, Black Hat USA, Code Blue Japan, HITCon Enterprise, and SINCON.

Modern enterprises are deploying LLMs into high‑risk workflows at a rapid pace, yet many rely on static, single‑shot testing to satisfy compliance requirements. This approach creates a dangerous illusion of safety. Our research into real‑world deployments, including a top‑tier medical institution and a leading enterprise AI provider, reveals that over 90% of vulnerabilities remain invisible to static tests, surfacing only through adaptive, multi‑turn interaction.

This session introduces an automated operational framework for Adaptive Multi‑Turn Red‑Teaming. We apply a closed‑loop validation model where testing strategies evolve based on model refusals to uncover hidden risks like policy disclosure and jailbreaks. Attendees will learn how to integrate this methodology with the OWASP AI Testing Guide, transforming theoretical checklists into continuous, resilient security controls within their SDLC and MLOps pipelines.

Shauna is a Security Investigative Analyst focused on maturing Stripe's Insider Threat program. She transitioned to tech after nearly five years as an FBI Intelligence Analyst, first tackling trust and safety at Meta before specializing in insider risk at Stripe. When not at work, you can usually find her outside, either running with her pitbull, regardless of the Wisconsin seasons, and/or gardening when the seasons allow.

Josh is an engineering manager with +10 years of experience in security, having led teams at Stripe and Facebook focused on insider threat detection and incident response. Prior to working in tech, he freelanced as an interpreter and translator for Spanish < > English. When not at his desk, he enjoys cycling, PNW nature, and handling a stubborn Bernese Mountain Dog named Snickers.

Managing insider risk is a complex challenge, often leaving security teams with reactive, hard‑to‑measure programs. This presentation details the journey of developing and implementing a bespoke maturity‑assessment model: Stripe’s Insider Threat Common Controls Framework (ITCCF).

We will explore the core principles that guided its creation, from its foundational pillars of Prevention, Detection, and Response, to the five‑level maturity scale used for assessment. This presentation will focus on the process: how we identified key controls, benchmarked them against industry standards, and built a framework tailored to our organization’s unique risks.

Attendees will gain insight into how Stripe has utilized this framework to methodically assess insider‑threat controls, using the findings to drive cross‑functional priorities within the insider‑risk space.

Matt is a seasoned anti-abuse advocate with over a decade of experience in email, cloud hosting, and general internet abuse. The internet community is where Matt’s passion lies. By coming together and sharing lessons learned, Matt believes that this community has the power and means to combat abuse on the internet. As Spamhaus's Community and Industry Partnerships representative, Matt gets to put his experience into practice, working alongside a multitude of companies, organizations, governments and law enforcement to drive forward Spamhaus's mission of making the internet a safer place for everyone.

Present‑day bulletproof hosts (BPHs), particularly those based in Western jurisdictions, are increasingly operating through distributed structures. By distributing key functions across multiple business entities, they obscure responsibility for abusive activity, becoming far more resistant to takedowns. What was once an advantage — owning everything from datacenter to virtual machines — has become a liability to BPHs, pushing them toward fragmented, disposable infrastructures.

In this TLP:AMBER session, we will present two case studies of distributed BPHs, and:

• Show how they evade anti‑abuse countermeasures.
• Discuss ways to incentivize cybercrime facilitators to adopt stronger vetting and abuse prevention.
• Explain Spamhaus’s approach to balancing protection, increasing costs for bad actors, and coordinating with law enforcement and the infosec community.

MORINO Masanori is a member of KINTO Technologies’ Security & Privacy Department and also contributes to the Toyota Financial Services IS Team. His work focuses on product security and security governance, and he joined KINTO Technologies in July 2022. He developed an interactive information security education program using board games, applying participatory methods to make security risks tangible and relatable across departments, including the use of generative AI to craft realistic training scenarios.

This session presents a practical case study of conducting a Technical Recovery Plan (TRP) exercise in a cloud‑native environment, triggered by a real‑world ransomware incident. The presentation covers the background and motivation for the exercise, the preparation process — including scenario design, product selection, and recovery planning — and the execution of the training itself.

Special attention is given to risk assessment and recovery strategies for AWS Aurora DB, as well as the challenges faced in restoring encrypted data and maintaining business continuity. Key lessons learned include the importance of clear communication, efficient information sharing, administrator‑account protection, and defining service‑level agreements (SLA) for recovery.

Attendees will gain actionable insights into operationalizing incident‑response methodologies and strengthening organizational resilience against ransomware and other cyber threats.

Dolev Taler is a senior security researcher at Varonis threat labs with over a decade of cybersecurity experience spanning red teaming, reverse engineering, vulnerability research, and malware analysis. He is passionate about machine learning and its pivotal role in modern threat detection, having developed advanced detection models, investigated ransomware attacks for major global enterprises, and reported vulnerabilities in critical infrastructure systems. Beyond tackling high-stakes cyber threats, Dolev also enjoys perfecting the art of coffee brewing and improving his lock-picking skills.

Mark Vaitsman, Security Research Team Leader – https://www.linkedin.com/in/mark-vaitzman/ Spoken at BlackHat USA 2025 Navigating the Identity Crisis: Why Authentication Keeps Failing. (recording available at BlackHat) Presented a research of “Beyond Flesh, Beyond Code: LLM based attack lifecycle with self-guided agent”, https://vimeo.com/1035325824. Presented at CrestCon twice, multiple Meetups, Webinars – available in Youtube, BrightTalk. Additionally, I am a Lecturer in a few Cyber Security colleges.

AI assistants feel like trusted companions — we share sensitive data, seek advice, and rely on them without hesitation. But what happens when that trusted companion turns into an insider threat with just one innocent click?

In this talk, we reveal a family of vulnerabilities we discovered in widely used AI assistants — among the most dangerous identified in the AI era, both for their ease of exploitation and their potential impact.

This session spotlights PromptJack, a one‑click attack that turns a harmless link into a data‑exfiltration weapon. This technique takes advantage of how AI assistants interpret link‑based input, making them execute hidden instructions automatically — leaking confidential data and even sending it to an attacker‑controlled server.

We’ll explore:

• How employing prompts as parameters in AI platforms can lead to unforeseen risks.
• Two critical vulnerabilities:
  • MS Copilot Exposure: A single click can unlock the entire user conversation history and stored memories.
  • Rovo Insider Threat: Atlassian’s AI assistant weaponized to leak PII and organizational secrets through crafted links.
• Why 1‑click attacks can be more devastating than 0‑click exploits.

Beyond showcasing these attacks, we’ll discuss real‑world implications and outline practical defense strategies for users and enterprises. Finally, we’ll provide guidance for security researchers on identifying other platforms vulnerable to PromptJack.

Daniel Gordon, CySA+, CISSP, CEH, GCIA, GCTI, GCFA is a cyber threat intelligence analyst with a background in network defense, digital forensics, incident response, and IT support. He has degrees in Political Science as well as Modeling and Simulation. He has published blogs in Dark Reading, War on the Rocks, and Risky.biz and spoken at a large number of events including MTEM, FTSCon, and SleuthCon.

My name is Daniel Gordon and I am a security researcher and expert on North Korean hacking. This message is to let you know that you have a serious problem and I encourage your team to take appropriate steps or relay this message to the correct individual. This talk is about the art of notification. Periodically security researchers will come across evidence of the successful or attempted compromise of an individual or organization. I certainly have, as part of analyzing North Korean activity for most of the past 10 years in both public and private sector. This talk will explore the decision about whether to perform a victim or target notification, the best approaches to conducting notifications, what information to include, and how to handle a notification when you are on the receiving end. This presentation will include some real-world examples (anonymized) of notifications gone right, as well as notifications gone wrong.

Joined the NTT DATA Group in 2019, initially working in sales, providing solutions such as image processing and natural language processing. In April 2023, transferred to the company’s CSIRT unit, NTTDATA-CERT, where engaged in incident response, threat hunting, IoC collection and distribution, as well as enhancing CSIRT operations through LLM-based automation. Also has a strong interest in offensive security, including C2 framework development, OSS vulnerability research, and participation in bug bounty programs. Presented at conferences such as Black Hat USA 2025 Arsenal, HITCON 2025, JSAC 2025, and BSides Tokyo 2025. CISSP, OSDA, OSTH.

In recent years, Digital Forensics and Incident Response (DFIR) tools have increasingly adopted Large Language Models (LLMs) to enhance automation, analysis, and reporting. Prominent examples include Velociraptor’s MCP integration and Timesketch’s AI Summary feature. This study empirically demonstrates that attackers can exploit prompt injection through boundary perturbation of structured data — a form previously considered resistant to manipulation.

By embedding malicious instructions into routine forensic artifacts such as logs and scheduled tasks, adversaries can cause DFIR LLM agents to misinterpret benign data as instructions, leading to three outcomes: Hide, Mislead, and Exploit. To the best of my knowledge, this is the first work to demonstrate structured‑data injection attacks in LLM‑integrated DFIR environments.

The study also proposes practical defense‑in‑depth countermeasures, including enforcing least privilege, mandating strict structured‑output validation, and maintaining human‑in‑the‑loop verification to ensure the reliability and safety of automated forensic workflows. This presentation aims to provide organizations advancing DFIR automation with LLM agents a foundation for rethinking, at the design level, how much autonomy should be granted to such agents and where human oversight must remain integral.

As VP Threat-Informed Defense at AttackIQ, Jon brings over 20 years of experience leading innovation in cybersecurity with a focus on making security more efficient and effective at scale. He is the former Director and Co-Founder of MITRE’s Center for Threat-Informed Defense (CTID), where he united sophisticated security teams to advance the state of the art and the practice in threat-informed defense globally. Prior to launching the CTID, Jon led MITRE’s Cyber Threat Intelligence and Adversary Emulation Department where he advanced those critical capabilities across MITRE and managed the CALDERA and MITRE ATT&CK® teams. Jon led teams developing open standards including STIX and TAXII for threat intelligence sharing and was the co-creator of OVAL while managing MITRE’s security automation program.

Many organizations struggle to apply threat intelligence effectively and measure progress in cyber defense. The INFORM threat‑informed defense maturity model is an open‑source tool designed to help security teams assess their current posture and systematically improve operations.

This talk introduces INFORM, guides attendees through a self‑assessment, and highlights practical steps for advancing threat‑informed defense. Attendees will leave with the tools to assess their organization’s maturity, actionable KPIs, and free resources to drive continuous improvement. This session empowers security teams to move from reactive operations to measurable, threat‑informed defense.

Tim Myers is the Principal Advisor for Incident Response in the Pacific Partnerships Team at NCSC New Zealand, where he focuses on delivering meaningful and impactful cyber capacity building in the region. Before joining NCSC, Tim served as a Digital Forensic Analyst with the New Zealand Police. In this role, he conducted digital forensic investigations related to serious crime, fraud and cybercrime. Building on his experience, Tim is dedicated to improving cyber security capabilities in the Pacific through fostering Pacific-led initiatives.

This talk explores the development of interactive tabletop exercises that engage participants by adding additional layers of realism. We will explore the development of a portable tabletop‑exercise platform that allows participants to connect their own devices to interact with each other and the scenario.

Ghislain de Salins is the Global Lead for Cybersecurity at the World Bank. He has helped developing countries' governments and cybersecurity teams establish, operate, upgrade and finance CSIRTs across Western Africa, Eastern Europe, the Caribbean and East Asia Pacific. He recently published a practitioner note entitled "Digital First Responders", which focuses on how to successfully build CSIRTs in developing countries. He previously worked for the OECD as a cybersecurity policy analyst.

Giacomo Assenza is a Cybersecurity Specialist in the Digital Development Unit of the World Bank. He has supported governments in establishing CSIRTs in Eastern Africa, Latin America and South Asia. He previously served as Cybersecurity Research Officer at the International Telecommunication Union (ITU) and recently earned a PhD in Engineering for Humans and Environment at the University Campus Biomedico, where he is also tutor for the Cybersecurity module. His research interests cover the development of cybersecurity strategies for the protection of critical sectors. Giacomo has a background in consulting and academia and has achieved several publications in academic, technical and educational journals.

Establishing and operating CSIRTs in low‑income, fragile environments can be particularly challenging. In many developing countries, CSIRTs face limited funding, uncertain legal landscapes, as well as difficulty in hiring and retaining skilled staff. Yet over the past decade, a growing number of low‑ and lower‑middle‑income countries have successfully established national and sectoral CSIRTs, often with support from development partners such as the World Bank and FIRST.

This panel will focus on practical lessons for doing more with less. Speakers from Togo, Sierra Leone, Mozambique, and the World Bank will share concrete “tips and tricks” based on real‑life experience: how to define a minimum viable CSIRT; prioritize services in the first 12–24 months; learn how to use open‑source tools and shared platforms (e.g., feeds from the Shadowserver Foundation, OpenCTI); build trust and legitimacy with constituents; and explore sustainable financing models from membership fees, government budgets, or private‑sector support.

Participants will leave with a realistic checklist, examples to replicate (and mistakes to avoid), and ideas for peer‑to‑peer collaboration.

Major General Teerawut Wittayakorn is the Deputy Secretary-General of the National Cyber Security Agency since October 2022, he is also the Director of the ASEAN-Japan Cybersecurity Capability Building Center (AJCCBC) and the Head of the Thailand Computer Emergency Response Team (ThaiCERT). Prior to take the office, he was in the military services for 25 years, his previous important positions included Director of Special Operation at Royal Thai Armed Forces, Signal Battalion Commander, Instructor at Royal Thai Army Command and General Staff College.

Scammer operations have rapidly evolved into organized and highly adaptive threat campaigns targeting individuals, enterprises, and national digital infrastructure. This session provides a structured understanding of scammer behavior, communication patterns, and attack flows that enable early detection.

By mapping real examples to practical threat‑analysis techniques, attendees will learn how to recognize indicators, classify scam events, and respond effectively. The talk also highlights how Thailand’s Cybersecurity Act B.E. 2562 supports this process, including incident classification, reporting obligations, and coordination requirements for organizations.

Participants will leave with actionable detection strategies and a clear, practical response workflow that can be implemented immediately to strengthen organizational resilience against scam‑driven threats.

Eric Zielinski is Chief Information Security Officer at Jumpmind, where he navigates the challenge at the heart of this talk: deploying AI to accelerate security while remaining accountable when those systems fail. With over two decades of cybersecurity leadership across Fortune 100 enterprises, financial services, and cloud-native SaaS platforms, he has built programs that treat AI governance as a security engineering problem, not a compliance checkbox.

As Director of AI and Cloud Security at OCC, Eric led efforts aligning generative AI governance with regulatory and enterprise risk frameworks, giving him firsthand experience with the "show me how this model makes decisions" questions now coming from regulators and boards. Previously, as CISO at Dizzion, he scaled security programs balancing innovation velocity with resilience.

Eric is a frequent speaker at industry conferences including several FIRST events, FS-ISAC, and many others, presenting on topics including securing generative AI and embedding cyber resilience in high-velocity development pipelines. He holds a Master's from Carnegie Mellon and founded Cyber Pathways, a career development initiative mentoring the next generation of cyber talent.

Security leaders face an impossible mandate: deploy AI everywhere while remaining accountable when it fails. Today’s AI systems make security‑consequential decisions — triaging alerts, blocking policy violations, evaluating access requests — yet we cannot explain how those decisions are made. We’re running unauditable security controls.

Recent advances in circuit sparsity offer a path forward. By forcing most of a model’s weights to zero, researchers have shown that the remaining connections form small, interpretable circuits implementing identifiable algorithms: a “string closer,” a “bracket counter,” a “variable‑type tracker.” These aren’t abstractions — they're the actual computational mechanisms we can now inspect, test, and harden.

This session translates circuit‑sparsity research into practical security engineering. We’ll examine real circuit examples, including one with a built‑in vulnerability exploitable through targeted adversarial inputs. We’ll map interpretability to AI threat models, showing how attackers probe for decision boundaries and how defenders can get ahead.

Finally, we’ll cover concrete applications: treating interpretability as a security control, building circuit‑informed red‑team methodologies, establishing AI‑security KPIs around circuit stability, and raising the bar for vendor transparency. The goal isn’t interpretability for its own sake — it’s shifting AI security from “trust the accuracy metrics” to “show me the control logic and prove it’s defensible.”

Marthe Råheim Rogndokken has a background spanning business, law enforcement, and cybersecurity. She has studied International Business in Slovenia. Later she graduated from the Norwegian Police Academy, and served as a police officer in both the first response unit and investigations. Her passion for technology and security led her to Australia, where she specialized further by completing a bachelor’s degree in cyber security. Marthe is currently a Cyber Threat Intelligence Analyst at Sopra Steria, Norway.

Her research on the PACT - a profiling and attribution model - was published in Procedia Computer Science on ScienceDirect 2025, and presented at the International Conference on Industry Sciences and Computer Science Innovation (iSCSi) in Portugal.

Marthe is an experienced public speaker, having presented at several conferences in Norway, including FIRST TC Oslo. She is well-versed in sharing knowledge with both technical and non-technical audiences.

Outside of work, Marthe is drawn to speed and adrenaline — whether it’s go-karting, surfing, or downhill mountain biking.

Every cyber attack raises the same question: Who did it? But what should you know before trying to find that out? This talk takes you through the first steps of getting started with threat‑actor profiling — exploring the attribution problem, profiling, existing attribution models, and PACT, a new framework in progress built to facilitate the cyberattack‑attribution process.

Key takeaways:
Attendees will learn how to get started with threat‑actor profiling, understand the key elements that should be included, and apply a structured methodology to the process. The session will also cover challenges and suggestions on how to address them.