0.18 botconf-2026 2026-04-14 2026-04-17 4 00:05 https://cfp.botconf.org https://cfp.botconf.org/media/botconf-2026/img/logo_H93Jc5M.webp Europe/Paris Room 1 Long workshop 2026-04-14T13:00:00+02:00 13:00 05:00 Android malware analysis can be intimidating, especially when samples employ aggressive obfuscation, layered encryption, anti-analysis techniques, and native code to conceal their behavior. This workshop is designed to guide analysts beyond these barriers and into a disciplined, scientific approach to understanding what modern Android malware actually does. Rather than treating obfuscation as a blocker, the workshop focuses on identifying it, understanding its purpose, and actively defeating it. Participants will learn how to recognize common and advanced obfuscation patterns, isolate relevant logic, and reconstruct the overall malware execution flow. The methodology presented combines static reverse engineering with dynamic analysis and runtime instrumentation, reflecting real-world workflows used by professional malware analysts. A core theme of the workshop is analyst efficiency and automation. Attendees will explore techniques to dynamically resolve encrypted code paths, automatically identify and neutralize encryption routines, and interact with malware at runtime. This includes injecting into the execution flow, patching binaries or memory on the fly, and forcing the execution of specific instructions to extract hidden behavior. The workshop begins with a custom-built Android application and progressively introduces techniques commonly found in modern Android malware. These techniques are applicable across malware families, including banking trojans, spyware, and more advanced threats, and are not tied to a single campaign or actor. To make the overall learning experience effective, the workshop includes a custom Capture the Flag (CTF) designed specifically for attendees. The challenges mirror real-world analysis scenarios, allowing participants to apply the techniques covered during the sessions immediately. botconf-2026-57-advanced-android-malware-analysis-defeating-obfuscation-in-the-real-world Workshops Alessandro StrinoFederico ValentiniMichele Roviello en false https://cfp.botconf.org/botconf-2026/talk/NVFNTX/ https://cfp.botconf.org/botconf-2026/talk/NVFNTX/feedback/ Room 2 Medium workshop 2026-04-14T13:30:00+02:00 13:30 04:00 Every time you open a malware sample in your favourite analysis tool and you are greeted with hundreds or thousands of functions with unknown names, you know it is time to find shortcuts and automate renaming steps whenever possible. This workshop dives into the recovery of function symbols. The examples in this workshop are all Golang related as the static compilation of Golang binaries serve as excellent examples. During this four hour workshop, you will dive into two different malware families which were used in the wild by threat actors, and find out how function symbol recovery works and how to apply the theory in practice. You will also learn how to create your own symbol databases, allowing you to use your privately analysed malware as the starting point for further research into the development of those malware families. Additionally, you will better understand how source code and compiled code relate, especially with regards to Golang files. Note that the taught techniques are applicable for any binary supported by Ghidra. You can reuse the techniques in other tools, albeit with (minor) changes depending on the specifics. botconf-2026-86-malware-symbol-recovery-with-ghidra-using-golang-examples Workshops Max 'Libra' Kersten en false https://cfp.botconf.org/botconf-2026/talk/FCE8FT/ https://cfp.botconf.org/botconf-2026/talk/FCE8FT/feedback/ Room 3 Medium workshop 2026-04-14T13:30:00+02:00 13:30 04:00 This hands-on workshop provides an in-depth exploration of advanced techniques for maximizing network threat detection using Suricata. Building upon core Suricata capabilities, this session delves into critical areas such as effective utilization of metadata keywords, including MITRE and regular metadata, to enrich detection context. Participants will learn practical methods for achieving fast Indicator of Compromise (IOC) matching and strategies for managing multiple Suricata versions within diverse environments. The workshop will also cover leveraging the Suricata Language Server (SLS) for rule development and optimization, including interpreting performance hints and implementing Continuous Integration (CI) for rulesets using SLS in batch mode. This session is designed for cybersecurity professionals seeking to enhance their Suricata expertise and implement cutting-edge threat detection strategies. Attendees will leave equipped with actionable techniques and practical examples to improve their organization's security posture. botconf-2026-96-threat-detection-engineering-with-suricata Workshops Éric LeblondPeter Manev en false https://cfp.botconf.org/botconf-2026/talk/Z8H9Y9/ https://cfp.botconf.org/botconf-2026/talk/Z8H9Y9/feedback/ Room 4 Long workshop 2026-04-14T13:00:00+02:00 13:00 05:00 Apple Silicon Macs introduce a radically different platform for digital investigations. Strong security controls, a closed boot chain, and limited support for external operating systems make traditional forensic workflows impractical. This workshop is designed for practitioners who need working techniques, not just theory, to analyze modern macOS systems in the field. We start by reviewing core live forensics principles, including software write-blocking, and compare traditional dead-box acquisition with live approaches. Realistic investigation scenarios are discussed, from local device access to remote and cloud-based systems, highlighting when live analysis is the only viable option. The workshop then focuses on booting strategies. After a brief comparison with PCs and servers, we dive into Apple Silicon-specific boot mechanics: standard boot, recovery mode, and failsafe recovery mode. Participants will learn how Apple’s boot design restricts custom OS loading and how these restrictions impact forensic workflows. A key part of the workshop explores what methods exist to access to Apple Silicon hardware. We explain the chainloading model, installation steps, and practical challenges such as hardware device trees and external boot constraints. Finally, we demonstrate how to boot and use live USB-based forensic operating system on Apple Silicon Macs. According to our knowledge, external USB boot is still a problem for Apple Silicon Macs, which has not been solved in any existing Linux distributions. However, we found a workaround which helps to solve this problem. We hope we will have a chance to present it publicly for the first time during Botconf 2026. The workshop concludes with a practical overview of building a custom live forensic OS, enabling investigators to tailor their tooling for modern macOS targets both locally and remotely. Requirements: 1. Apple Silicon Macbook (M1 or M2) 2. USB-C flash drive (at least 64GB) 3. USB-C cable and a secondary laptop botconf-2026-65-inside-apple-silicon-practical-live-forensics-on-modern-macs Workshops Vitaly KamlukNicolas Collery en false https://cfp.botconf.org/botconf-2026/talk/XSZJ3C/ https://cfp.botconf.org/botconf-2026/talk/XSZJ3C/feedback/ Amphitheater Long talk 2026-04-15T11:00:00+02:00 11:00 00:10 botconf-2026-111-opening-speech Animation en false https://cfp.botconf.org/botconf-2026/talk/XJQ33E/ https://cfp.botconf.org/botconf-2026/talk/XJQ33E/feedback/ Amphitheater Regular talk 2026-04-15T11:10:00+02:00 11:10 00:30 APK malformation has ceased to be a niche evasion tactic; it is now the de facto standard for anti-analysis in the modern Android threat landscape. Implemented by default in the vast majority of Malware-as-a-Service (MaaS) builders and crypters, this technique allows families like TeaBot, TrickMo, and SpyNote to exploit Android's installation leniency while crippling traditional static analysis tools. By intentionally corrupting the APK structure, Threat Actors cause standard parsers (e.g., JADX) to crash or yield incomplete data, effectively blinding analysts and breaking automated triage pipelines. In this session, we will present a comprehensive dissection of these techniques, categorized into three pillars: - ZIP Structure Manipulation: Exploiting parser discrepancies via Unsupported Compression Methods and deliberate Local File Header/Central Directory mismatches. - AXML Obfuscation: Corrupting the AndroidManifest binary XML through Attribute Size Violations and String Pool manipulation to exploit parser rigidity. - Asset Directory Abuse: Leveraging non-ASCII characters to induce path traversal errors. Critically, the defensive landscape lacks consolidated tools to reliably handle these malformations. To bridge this gap, we introduce Malfixer, a specialized utility that has been developed and refined over the past two years within our threat intelligence operations. We will demonstrate how Malfixer detects and surgically repairs structural corruptions, restoring file integrity without altering the payload, to unblock large-scale triage and classification pipelines. Finally, Malfixer will be officially released as open-source during this talk. This contribution aims to provide analysts with a standard for APK repair and to foster a collaborative framework, enabling the community to extend capabilities against future, yet unknown, malformation techniques. botconf-2026-56-broken-by-design-defeating-apk-malformation-at-scale-in-the-maas-era Main conference Alessandro StrinoFederico ValentiniMichele Roviello en false https://cfp.botconf.org/botconf-2026/talk/LRJGDK/ https://cfp.botconf.org/botconf-2026/talk/LRJGDK/feedback/ Amphitheater Regular talk 2026-04-15T11:40:00+02:00 11:40 00:30 Distributed Denial of Service (DDoS) attacks continue to pose a significant threat to online services. The raw bandwidth and packet rate of DDoS attacks keeps increasing, and attack methods keep adapting to new mitigation techniques. This results in a never-ending cat-and-mouse game between defenders and attackers. In addition, the vast DDoS-for-Hire market makes it increasingly easy for new adversaries to enter the DDoS space. With just a few dollars and a few clicks, users can get hold of DDoS tools powerful enough to take down any target they like. Having multiple providers implies competition, each fighting to have the most attack power and get the most paying users. In order to measure the strength of their networks, DDoS-for-Hire providers abuse legitimate services as "trusted third parties" to get accurate measurements on performed DDoS attacks, called "Power Proofs". This raises the question: **what is the impact of Power Proofs on the DDoS-for-Hire market?** In this talk, we present our findings concerning these DDoS Power Proofs. We show which services are abused by the community to create power proofs and how they use the results to build leaderboards. We investigate whether advertisements and claims are accurate, and analyze whether power proofs have an impact on the usage of DDoS networks. Our goal: investigating the impact of Power Proofs on the DDoS-for-Hire market. During the presentation, we will show the data we collect concerning DDoS power proofs. We leverage self-reported statistics of DDoS-for-Hire providers, Telegram messages and DDoS test attack logs to get a "big picture" overview of the inner workings of the DDoS-for-Hire market. We also share a live dashboard showing live observations of DDoS test attacks. botconf-2026-90-botnet-boasting-investigating-power-proofs-in-the-ddos-for-hire-market Main conference Maarten Weyns en false Video Handout version of the presentation https://cfp.botconf.org/botconf-2026/talk/ZNA3TZ/ https://cfp.botconf.org/botconf-2026/talk/ZNA3TZ/feedback/ Amphitheater Long talk 2026-04-15T12:10:00+02:00 12:10 00:45 In February 2026, Orange Cyberdefense CERT responded to a ransomware incident affecting a European organization. The intrusion began with a malvertising chain leading to a trojanized RVTools installer and the deployment of the SmokedHam backdoor, ultimately culminating in Qilin ransomware encryption of ESXi virtual machines. This presentation reconstructs the full infection chain - from Google Ads to extortion - and details the attacker’s post-compromise tradecraft. Beyond SmokedHam, the case highlights several notable techniques: abuse of employee monitoring (“bossware”) tools to blend malicious activity with legitimate user behavior, domain fronting via Cloudflare Workers, systematic use of AWS infrastructure for staging and exfiltration, and the recurring use of revoked Extended Validation code-signing certificates obtained through impersonation of Asian businesses. We also analyze more than 30 SmokedHam samples collected in 2025–2026, exposing continuous malware evolution, variant testing, and iterative refinement of persistence and staging mechanisms. Technical overlaps and operational patterns strongly align with UNC2465, a Russian-speaking ransomware affiliate historically linked to DarkSide, LockBit, and Hunters International. The deployment of a Qilin encryptor suggests a shift in affiliation during 2025. By pivoting on typosquatted domains, and analyzing underground forum activity, we are able to share new insights on the affiliate’s modus operandi, including its traffer recruitment and recent incapacity to manipulate or delete Veam Cloud backups. botconf-2026-122-smoking-out-an-affiliate-smokedham-qilin-a-few-google-ads-and-some-bossware Sprint CFP Alexis GoodfaithMarine PichonThomas en true https://cfp.botconf.org/botconf-2026/talk/TVKBBF/ https://cfp.botconf.org/botconf-2026/talk/TVKBBF/feedback/ Amphitheater Regular talk 2026-04-15T14:00:00+02:00 14:00 00:30 Minecraft is a popular video game with a massive global player base. With over 200 million monthly active players, making it one of the best-selling video games ever. Minecraft supports mods (user-created modifications), which enrich the user experience by improving gameplay, fixing bugs, enhancing graphics, and adding new content. This popularity got noticed by cybercriminals, who create stealers in form of game mods and disguise them as game cheats, cracks, or macros. These stealers are then uploaded to file sharing platforms and links to them are distributed via various distribution platforms (instant messengers, social media, video sharing). When installed and executed by unsuspecting victims, these stealers collect a wide range of data from infected devices, causing loss of (not only) game accounts and their associated assets. In this presentation, we examine the current landscape of Minecraft stealers and analyze the most common techniques employed by cybercriminals to deceive users. We will focus on a few prolific stealer families, dissecting their entire infection chains from initial engagement to the final payload delivery. Examples of Youtube videos advertising game cheats with misleading descriptions, repositories controlled by the Stargazers Github Network, mod sharing websites, and such similar will be presented. We will demonstrate our approach to analyzing (both statically and dynamically) these often multi-layered, obfuscated packages and extracting critical artifacts, such as campaign IDs and command-and-control (C&C) servers, from the samples. Additionally, we will analyze several notable malware families observed in the wild, including: a) Baikal Stealer - multi stage stealer with anti-analysis capabilities. b) Maks RAT - multi stage stealer, with builder, loader, Discord spamming module, and main stealing module. Very popular among ratters (cybercriminals distributing malware), often rebranded, with regularly appearing new building servers. botconf-2026-85-from-mods-to-malware-dissecting-minecraft-stealer-campaigns Main conference Jaromir Horejsi en false https://cfp.botconf.org/botconf-2026/talk/QCFKFM/ https://cfp.botconf.org/botconf-2026/talk/QCFKFM/feedback/ Amphitheater Long talk 2026-04-15T14:30:00+02:00 14:30 00:45 Information stealers have become a core component of modern cybercrime, driven by their availability, ease of use, rapid evolution, and direct path to monetization. This talk examines Stealerium and PhantomStealer, two closely related infostealer families that demonstrate how open-source and so-called (and sometimes, falsely-claimed) “ethical hacking” tools are routinely repurposed for real-world attacks. The session begins with background on Stealerium’s origins, overlap with other families, and distribution models, including how multiple threat actors leverage and modify the malware. We will explore the technical relationship between Stealerium and PhantomStealer, highlighting areas of code reuse and key differences in functionality. From there, we’ll dive into technical analysis of the malware, covering what data these stealers target, ranging from browser credentials and Wi-Fi information to cryptocurrency wallets, clipboard data, and content flagged as “Not Safe for Work,” which may be used to support sextortion activity. The presentation also breaks down Stealerium’s unique exfiltration methods, including the use of uncommon services such as GoFile and ZulipChat, along with its anti-analysis and anti-sandbox techniques. Finally, we’ll examine notable campaigns, attack chains, and practical methods for tracking, detecting, and mitigating Stealerium using configuration extraction and behavioral indicators. botconf-2026-78-for-educational-purposes-mostly-tracking-the-stealerium-and-phantomstealer-ecosystem Main conference Kyle Cucci en false Presentation https://cfp.botconf.org/botconf-2026/talk/QCZ39R/ https://cfp.botconf.org/botconf-2026/talk/QCZ39R/feedback/ Amphitheater Long talk 2026-04-15T16:00:00+02:00 16:00 00:45 Over the past few years, the Adversary-in-the-Middle (AitM) phishing threat has evolved into a highly professionalised market featuring numerous Phishing-as-a-Service (PhaaS) platforms. For a subscription costing a few hundred dollars, these platforms offer fully-featured phishing kits with regular updates and professional support. In this presentation, we will demonstrate how this professionalised ecosystem empowers low-skilled threat actors to conduct phishing campaigns, and how to investigate them. First, we will analyse the PhaaS market, where Telegram serves as the central hub for sales and support. To present an overview of the threat landscape, we will provide a timeline, statistics, and context for major PhaaS platforms, including Tycoon 2FA, Storm-1167, NakedPages, Sneaky 2FA, and Mamba 2FA, supported by our telemetry data. We will also examine the evolution of delivery techniques, from QR codes in 2023 to SVG files in 2025. Next, we will detail our research methodology for unveiling emerging AitM phishing kits through proactive threat hunting using common TTPs. We will present Sneaky 2FA as a case study, providing context on code reuse and its evolution into two previously undocumented variants: Kratos (a decentralised kit) and Smile Cookies (featuring centralised infrastructure). We will share actionable tracking methods including infrastructure fingerprinting, and detection opportunities from authentication log anomalies. Finally, we will present an attribution case study of the threat actor “Dr. James Wilson”, who operated four PhaaS platforms and whose operational security failures led to exposure via infostealer logs. Our analysis of browsing data revealed two digital identities - one for AitM phishing operations and another for personal activities. By profiling the attacker, we will share valuable insights into the ecosystem and services facilitating AitM phishing, from domain registration to cryptocurrency platforms. botconf-2026-37-exploring-the-aitm-phishing-ecosystem-from-kit-hunting-to-operator-profiling Main conference Quentin BourgueGrégoire Clermont en false https://cfp.botconf.org/botconf-2026/talk/XRVBAC/ https://cfp.botconf.org/botconf-2026/talk/XRVBAC/feedback/ Amphitheater Regular talk 2026-04-15T16:45:00+02:00 16:45 00:30 We explored a decade of open-source offensive tools used in operations worldwide. After analysing hundreds of APT reports and threat-intelligence publications, we compiled a collection of tunnelling tools, reverse shells, loaders, RATs, and living-off-the-land components that threat actors have repeatedly repurposed. This presentation examines if these legacy tools still “work,” how reliably they operate today, and, most critically, whether modern AV and EDR solutions still detect them. We evaluated whether security products have deprioritized or even dropped signatures for aging tools, inadvertently creating blind spots that sophisticated threat actors continue to exploit. botconf-2026-35-tomb-raider-in-search-of-the-lost-signatures Main conference Stephan Berger en false Botconf Tomb Raider https://cfp.botconf.org/botconf-2026/talk/KS7T97/ https://cfp.botconf.org/botconf-2026/talk/KS7T97/feedback/ Amphitheater Long talk 2026-04-15T17:15:00+02:00 17:15 00:45 In 2025, we observed a new backdoor, LaxGopher, being deployed within a government institution of Mongolia by a previously unknown China-aligned group that we named GopherWhisper. Following this discovery, we uncovered additional backdoors that use various legitimate cloud-based services as C&C infrastructure. By analyzing the C&C traffic using API tokens stashed in the various backdoors, for Slack, Discord, and Microsoft Graph, we obtained insights into the group’s internal operations and post-compromise activities. From the analysis of all C&C traffic, we recovered over 5,000 messages, revealing that the group’s earliest activity began in 2023-11. These messages were pivotal to our research as it helped in identifying times of when threat actors were most active, commands issued on targets, and tools deployed. Notably, it was through these messages that we were able to extract previously unknown tools such as CompactGopher and other information stealers. The dataset further exposed testing artifacts, including enumerations from the testing machines and snippets of backdoor code uploaded by testers.. Our research and analysis of GopherWhisper resulted in identifying a variety of custom tools that include Go-based backdoors LaxGopher, RatGopher, and BoxofFriends, an injector named JabGopher, a loader called FriendDelivery, an exfiltration tool, CompactGopher, and a C++ backdoor, SSLORDoor. From what we see in messages and telemetry, these tools were often deployed resulting in data exfiltration through either the C&C server or the simple file sharing service, file.io. In this session, we will dissect the most interesting tools in GopherWhisper’s arsenal and will share how analyzing C&C traffic and code snippets from the attackers’ cloud accounts helped us gain critical insights into their activities. Finally, we will provide tips for fellow defenders to uncover and remediate a GopherWhisper compromise. botconf-2026-31-meet-gopherwhisper-uncovering-an-apt-s-secrets-through-its-own-words Main conference Eric Howard en false https://cfp.botconf.org/botconf-2026/talk/F8XN8H/ https://cfp.botconf.org/botconf-2026/talk/F8XN8H/feedback/ Reception area Long talk 2026-04-15T10:00:00+02:00 10:00 01:00 botconf-2026-107-registration Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/CZ8UTE/ https://cfp.botconf.org/botconf-2026/talk/CZ8UTE/feedback/ Reception area Lightning talk 2026-04-15T12:55:00+02:00 12:55 01:05 botconf-2026-101-lunch Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/LSXRR7/ https://cfp.botconf.org/botconf-2026/talk/LSXRR7/feedback/ Reception area Long talk 2026-04-15T15:15:00+02:00 15:15 00:45 botconf-2026-104-coffee-break Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/TUNUTZ/ https://cfp.botconf.org/botconf-2026/talk/TUNUTZ/feedback/ Reception area Long talk 2026-04-15T18:00:00+02:00 18:00 01:30 botconf-2026-114-cocktail-party Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/RCSB3Z/ https://cfp.botconf.org/botconf-2026/talk/RCSB3Z/feedback/ Amphitheater Regular talk 2026-04-16T09:00:00+02:00 09:00 00:30 Once a subscription is established, a calendar server can deliver any amount of events in your schedule, some which may contain harmful content, turning a helpful tool into an unexpected attack vector. The lack of awareness surrounding calendars, creates a dangerous blind spot in both personal and corporate security ecosystems. In this investigation we unveil a growing ecosystem, vast dedicated networks that deceive users at scale into subscriptions: from compromising websites, to redirecting victims and tricking them into subscriptions via fake captchas. This subscription “space”, which allows actors to create any amount of events in your calendars, is then either used by the actors themselves or sold to third-parties as-a-service. By pivoting, we sinkholed part of 2 networks conducting this operation, in return we received daily requests from Millions of iOS devices. Here we uncover the tactics and techniques utilized by this dedicated infrastructure, but also the risks a subscribed user/organization might incur (phishing, malware, etc), culminating with the economic motivation behind the services currently selling this “space”. Lastly we conclude with some exploratory work on possible correlations between proxy botnets/services that might be utilizing this illegitimate infrastructure to “acquire” new proxy nodes. The intent is to share this ecosystem with the community so further correlations can be explored. We terminate with some open discussion / early thoughts on challenges of mapping, and potential use of this new ecosystem to track active campaigns. botconf-2026-48-the-dangers-of-calendar-subscriptions-a-new-ecosystem-unveiled Main conference Pedro FaléAna Rita Castanheira en false https://cfp.botconf.org/botconf-2026/talk/PDDAWC/ https://cfp.botconf.org/botconf-2026/talk/PDDAWC/feedback/ Amphitheater Regular talk 2026-04-16T09:30:00+02:00 09:30 00:30 The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative dedicated to collecting, analyzing, and responding to computer security threats and incidents. As part of its mission, CIRCL operates a IPv4 /18 network telescope (black-hole address space) observing unsolicited Internet traffic. This presentation introduces the foundations of network telescopes and their value for observing Internet background noise, scanning activity, botnet behavior, malicious probing, and misconfigurations. Since no legitimate services are hosted, all captured traffic provides an unbiased view of Internet-wide malicious activity. The talk then presents the data processing pipeline deployed at CIRCL, from ingestion and normalization to long-term storage in a queryable data lake, enabling large-scale and longitudinal analysis. Several concrete use cases are discussed, including scanner and bot detection through activity correlation and PTR analysis, identification of SNMP scanning campaigns, detection of emerging CVE trends by port and scanner type, Mirai botnet fingerprinting using TCP SYN window sizes, and DDoS victim identification via backscatter traffic. Operationally, these observations are used to generate warning lists and early alerts for CIRCL constituents. Relevant events and indicators are shared through MISP or Warning lists, enabling collaborative detection and response. Overall, the talk shows how actionable security intelligence can be extracted from unused address space, turning “the void” into a powerful Internet-scale security observatory. botconf-2026-68-finding-meaning-in-dev-null Main conference Paul Jung en false Finding meaning in /dev/null https://cfp.botconf.org/botconf-2026/talk/QW87UH/ https://cfp.botconf.org/botconf-2026/talk/QW87UH/feedback/ Amphitheater Regular talk 2026-04-16T10:00:00+02:00 10:00 00:30 For years, software supply chain security in ecosystems like npm and PyPI was treated as a "developer problem"- an issue delegated to posture management tools and policy enforcement. However, the threat landscape has fundamentally changed. Since 2025, we are no longer facing just simple credential stealers; we are witnessing massive, sophisticated campaigns involving destructive malware and self-replicating worms. This shift is exacerbated by the explosion of "vibe coding" and AI-assisted development. As the definition of "developer" expands, more users are implementing code they do not fully understand, while attackers leverage AI to compromise packages or hallucinate new ones at scale. In this session, we start by analyzing the anatomy of these modern compromises: how they happen and what they typically execute. Then, we strip away the abstraction. When a developer runs npm install or pip install, they aren't just downloading code; they are executing a process tree with the full privileges of that user. We will demonstrate that visibility into the endpoint is the missing link in supply chain defense. By the time a malicious package is reported and removed from the public registry, it is often too late- the code has already run. We will expose the attacker’s playbook, dissecting notable campaigns to reveal their tradecraft. We will break down every step of the kill chain, mapping the attacks from the initial install command to the malicious child processes and network beacons. Attendees will leave with more than just theory. The session concludes with practical hunting tips and specific query logic, empowering defenders to detect these anomalies in their own environments and spot the signs of a compromised supply chain before it spreads. botconf-2026-83-thinking-outside-the-package-hunting-supply-chain-behavior-from-the-endpoint-perspective Main conference Bar MatalonNoa Dekel en false https://cfp.botconf.org/botconf-2026/talk/KXSKJ7/ https://cfp.botconf.org/botconf-2026/talk/KXSKJ7/feedback/ Amphitheater Long talk 2026-04-16T11:00:00+02:00 11:00 00:45 XLoader is an actively developed rebrand of the well known Formbook information stealer. First appearing in 2020, XLoader builds on the strengths of its predecessor with a particular focus on improving the build engine to complicate analysis and large-scale IOC extraction. Addressing this challenge is crucial for organizations aiming to track XLoader at scale. This talk brings together presenters from Check Point and Intel 471, each using distinct methodologies and tooling to build reliable tracking for XLoader. Intel 471’s approach is primarily based on manual reverse engineering, while Check Point’s approach combines generative AI with targeted manual analysis to accelerate this process. The talk is intended to serve as a reference for reverse engineers seeking a practical entry point into automating XLoader tracking, with a focus on configuration extraction and C2 communications. botconf-2026-75-chasing-xloader-tracking-a-notoriously-complex-malware-family-at-scale Main conference Alexey BukhteyevSouhail Hammou en false Presentation slides https://cfp.botconf.org/botconf-2026/talk/ZMLEUB/ https://cfp.botconf.org/botconf-2026/talk/ZMLEUB/feedback/ Amphitheater Long talk 2026-04-16T11:45:00+02:00 11:45 00:45 In early September 2025, we observed a new malware campaign in which attackers hijacked the official GitHub Desktop repository to distribute a multi-stage loader disguised as the GitHub Desktop installer. This loader, dubbed GPUGate, ultimately delivers HijackLoader and cleverly uses a GPU-based API called OpenCL to evade sandbox and VM-based analysis, and to obscure the decryption key from analysts. In our case, this forced us onto a physical machine with a GPU, where I could debug the loader, understand its functionality, and recover the correct decryption key. In this talk, I will provide a detailed explanation of how OpenCL works, and how it can be abused to evade sandbox analysis and hinder static decryption, using techniques observed in this campaign. You will learn how to spot and work around these techniques and gain a deeper understanding of OpenCL-based malware. I will also discuss our research into the initial delivery technique (which I dubbed repo squatting). This is enabled by GitHub’s fork-network commit visibility, which allows attackers to “squat” under an official repository’s namespace via commit hashes. I will show how similar platforms are affected, and share the new methods the attackers are using to expand their victim count in 2026. botconf-2026-119-gpugate-repo-squatting-and-opencl-anti-analysis-to-deliver-hijackloader Sprint CFP Theo WebbShungo Kumasaka en false Presentation Slides https://cfp.botconf.org/botconf-2026/talk/HKUTDC/ https://cfp.botconf.org/botconf-2026/talk/HKUTDC/feedback/ Amphitheater Regular talk 2026-04-16T13:45:00+02:00 13:45 00:30 Malware configuration data often holds the key to understanding a threat actor’s intent, infrastructure, and operational scope. Yet, as adversaries evolve their tooling, extracting this configuration information has become a progressively cumbersome challenge for analysts. This talk provides a hands-on exploration of how malware stores, hides, and protects its configuration; moving from easily accessible static artifacts to deeply obfuscated and encrypted structures. Starting with fundamental patterns and low-hanging fruits, we’ll walk through practical examples of locating embedded configuration data in binaries, analyzing common encoding routines. The session then escalates to advanced cases where adversaries deploy custom encryption layers, smart contracts, or dynamically generated configuration schemas - illustrated through live demonstrations of real-world samples. To ground these techniques in recent reality, the talk highlights several emerging malware families observed in the wild throughout recent years. Each case-study outlines how the configuration is structured and stored, and demonstrates the methods and the logic used to extract and decode it - offering actionable know-how directly transferable to day-to-day reverse engineering. Attendees will gain not only conceptual insights into malware configuration structures across different malware families but also actionable findings for configuration extraction workflows. By the end of the talk, participants will be able to tackle both the straightforward and the sophisticated: turning malware configuration data into actionable threat intelligence. botconf-2026-14-decoding-the-core-inside-stories-of-malware-configuration-extraction Main conference Albert Zsigovits en false https://cfp.botconf.org/botconf-2026/talk/PRKMGZ/ https://cfp.botconf.org/botconf-2026/talk/PRKMGZ/feedback/ Amphitheater Regular talk 2026-04-16T14:15:00+02:00 14:15 00:30 Prior to 2023, commodity information stealers targeting macOS remained a niche activity rarely found advertised in cybercrime communities. The March 2023 release of COOKIE SPIDER’s Atomic macOS Stealer (aka AMOS) sparked rapid adoption among Russian-speaking “traffer” groups and, subsequently, the rise of many competitor stealer projects that continue to proliferate to this day. This talk will trace the origins of AMOS and its main operator, COOKIE SPIDER, as well as profile its major competitors, touching on similarities and differences between each malware family, their customers, and novel distribution methods and trends. We will also showcase the use of crypto analysis to map relationships between stealer vendors, their customers, and their infrastructure. The presentation will also highlight the ecosystem in which macOS malware vendors and users exist including the monetization of their infections via cryptocurrency theft, sale of logs, and the emergence of some of the first Pay-Per-Install (PPI) services leveraging macOS infections. We will also conclude our talk with a look at recent and future trends in commodity macOS malware development. botconf-2026-72-imac-ulate-conception-the-birth-of-the-macos-stealer-ecosystem Main conference Maddie StewartCharlie Cullen en false https://cfp.botconf.org/botconf-2026/talk/SMH7QS/ https://cfp.botconf.org/botconf-2026/talk/SMH7QS/feedback/ Amphitheater Long talk 2026-04-16T15:30:00+02:00 15:30 00:45 Exploitation of internet exposed devices is not new, yet we keep seeing threat actors abusing this vector to create botnets. In 2025 one new botnet named RondoDox started making some waves due to its aggressive scanning and exploitation approach, making use of dozens of vulnerabilities in internet exposed devices. In this talk we'll do a deep technical dive into this fairly new botnet, focusing on the activity observed between its emergence in May 2025 and the end of the year. We'll go over their infection chain, starting with the wide-variety of used exploits, and we'll then look into the infrastructure supporting the scanning and exploitation, and the dropper and implants used. From there we'll dive into the technical details of the malware, focusing on details that enable researchers to quickly identify it, how its network protocol communicates with the C2, and highlighting the diverse DoS capabilities at different network levels built into the malware. We'll also explore the evolution of the threat with observed changes in both the infrastructure and malware, that highlight the active development of this threat, as well as some operational details regarding patterns in the activity and telemetry information. By the end of the session the audience will have a comprehensive understanding of this recent threat. The audience will also be able to identify, monitor, and track RondoDox activity within their own environments. botconf-2026-44-following-rondodox-s-breadcrumbs Main conference João Godinho en false https://cfp.botconf.org/botconf-2026/talk/9LHJCG/ https://cfp.botconf.org/botconf-2026/talk/9LHJCG/feedback/ Amphitheater Long talk 2026-04-16T16:15:00+02:00 16:15 00:05 botconf-2026-113-lightning-talks Animation en false https://cfp.botconf.org/botconf-2026/talk/ACWXFQ/ https://cfp.botconf.org/botconf-2026/talk/ACWXFQ/feedback/ Amphitheater Lightning talk 2026-04-16T16:20:00+02:00 16:20 00:03 Presentation of a tool and its results for monitoring C2 by simulating fake victims with python script botconf-2026-132-lt01-how-to-become-a-bot-farmer Lightning talk Clément CARDIN en false https://cfp.botconf.org/botconf-2026/talk/CHJMSY/ https://cfp.botconf.org/botconf-2026/talk/CHJMSY/feedback/ Amphitheater Lightning talk 2026-04-16T16:23:00+02:00 16:23 00:03 Quick overview of the new features in Ransomlook 2.0. RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. botconf-2026-133-lt02-introducing-ransomlook-2-0 Lightning talk /media/botconf-2026/submissions/CDAUV3/ransomlook_7cZOIZr.svg Tammy Harper en false https://cfp.botconf.org/botconf-2026/talk/CDAUV3/ https://cfp.botconf.org/botconf-2026/talk/CDAUV3/feedback/ Amphitheater Lightning talk 2026-04-16T16:26:00+02:00 16:26 00:03 A proxy botnet bills itself as a monetization SDK for Android apps: consent API, bandwidth caps, the works. It also distributes binaries via IPFS, discovers C2 servers through encrypted Ethereum Name Service records, polls a blockchain for updates like `apt update`, and ships a custom P2P mesh relay. The operator built three layers of decentralized resilience on the assumption that compute is free when it belongs to someone else. When a researcher published IOCs for that proxy botnet infrastructure in early April, we began monitoring the download server where the APK was being delivered to devices compromised through proxy-to-ADB exploitation (the same initial access used by Kimwolf). Within weeks, the SDK gained three DDoS flood modules and a template-push system for rotating HTTP payloads. The proxy service had become a dual-purpose attack platform. This lightning talk traces the operator architecture from proxy to botnet: the ENS update manifest, the IPFS distribution pipeline, and the moment the operator decided bandwidth monetization wasn't enough. botconf-2026-134-lt03-ens-ipfs-and-a-custom-mesh-network-walk-into-a-botnet Lightning talk Jérôme Meyer en true https://cfp.botconf.org/botconf-2026/talk/N88ZFD/ https://cfp.botconf.org/botconf-2026/talk/N88ZFD/feedback/ Amphitheater Lightning talk 2026-04-16T16:29:00+02:00 16:29 00:03 The ligthning talk will dive into a malware family delivered by fake cheating softwares advertised on youtube with videos published on hacked channels. The malware itself is built using .NET NativeAOT and invoke multiple stages, including drivers installation for BYOVD purposes and EDR/Antivirus killing. botconf-2026-135-lt04-from-cheats-to-apt-or-how-a-youtube-ad-made-me-loose-all-my-free-time Lightning talk Paul Daligault en false https://cfp.botconf.org/botconf-2026/talk/CJVJND/ https://cfp.botconf.org/botconf-2026/talk/CJVJND/feedback/ Amphitheater Lightning talk 2026-04-16T16:32:00+02:00 16:32 00:03 Earlier this year, we identified 2 DLL samples impersonating legitimate products and tools uploaded from Kazakhstan to a popular online file analysis platform. These DLLs notably provide an operator with command execution and file download capabilities, and rely on Telegram for C2 communication. In this lightning talk, we will present the operators' activity journal that we were able to retrieve from the Telegram channels. botconf-2026-136-lt05-one-day-in-the-life-of-a-threat-actor-targeting-kazakhstani-diplomatic-entities Lightning talk Pierre L. en true https://cfp.botconf.org/botconf-2026/talk/PAF7CV/ https://cfp.botconf.org/botconf-2026/talk/PAF7CV/feedback/ Amphitheater Lightning talk 2026-04-16T16:35:00+02:00 16:35 00:03 Some malware samples open Spotify—mostly as a distraction and obfuscation technique. In this lightning talk, I show in a high-level how I analyzed this behavior, share key findings, and present a small dashboard I built to explore the data:https://www.mboll.eu/spotify-malware-dashboard.html The collected data is also shared as JSON for further analysis: https://www.mboll.eu/data/pocketbase_export.json More details in the blog post: https://www.mboll.eu/posts/what_music_does_malware_listen_to/ botconf-2026-137-lt06-what-music-does-malware-listen-to Lightning talk Manuel Boll en false https://cfp.botconf.org/botconf-2026/talk/77JLMK/ https://cfp.botconf.org/botconf-2026/talk/77JLMK/feedback/ Amphitheater Lightning talk 2026-04-16T16:38:00+02:00 16:38 00:03 Short talk about our articles within Fake IT workers from DPRK from Kudelski security research https://kudelskisecurity.com/research/inside-the-cyber-infrastructure-behind-dprk-fake-it-worker-operations https://kudelskisecurity.com/research/dprk-fake-it-workers-fraud-playbook https://kudelskisecurity.com/research/inside-the-dprk-fake-it-worker-network-ip-ranges-proxies-and-internal-coordination botconf-2026-138-lt07-fake-it-workers-infrastructure-in-3-minutes Lightning talk Clifford en true https://cfp.botconf.org/botconf-2026/talk/WU89DM/ https://cfp.botconf.org/botconf-2026/talk/WU89DM/feedback/ Amphitheater Lightning talk 2026-04-16T16:41:00+02:00 16:41 00:03 botconf-2026-140-lt08-a-crash-course-in-pop-culture-the-kimwolf-way Lightning talk /media/botconf-2026/submissions/9JKPYT/image_2026-04-16_113130454_rCkc_Oi8LT7M.webp Gwendal Saloum en false https://cfp.botconf.org/botconf-2026/talk/9JKPYT/ https://cfp.botconf.org/botconf-2026/talk/9JKPYT/feedback/ Amphitheater Lightning talk 2026-04-16T16:44:00+02:00 16:44 00:03 Short lightning telling about real funny French cyber police cases which had some funny stories. All cases are officially closed ; no personal data disclosed. botconf-2026-141-lt09-random-cyber-fails-police-pov Lightning talk François Lexis en true https://cfp.botconf.org/botconf-2026/talk/JCWZS3/ https://cfp.botconf.org/botconf-2026/talk/JCWZS3/feedback/ Amphitheater Lightning talk 2026-04-16T16:47:00+02:00 16:47 00:03 What drives people to spend nights reversing binaries, fuzzing protocols, or hunting for zero-days — as a job, a passion, or both? How do they actually practice their craft? And how well do they know the legal boundaries of what they do? The PEPR Cybersécurité REV project, a multi-disciplinary research effort at the crossroads of cybersecurity, law, and sociology, is launching a study to explore these questions. Through a privacy-preserving online survey, the team aims to map the plurality of backgrounds, the diverse motivations, and the many career paths that lead people into vulnerability research, understand their day-to-day practices and methodologies, and assess this community's awareness of the legal framework governing vulnerability discovery and disclosure. This lightning talk introduces the study, its goals, and its privacy-first methodology. It is also a call to action: whether you are an active vulnerability researcher, have dabbled in the past, or simply work alongside those who do, if this topic resonates with you, we invite you to sign up for notification when the survey goes live. botconf-2026-142-lt10-the-people-behind-the-cves Lightning talk Dario NISI en false https://cfp.botconf.org/botconf-2026/talk/A3XS7T/ https://cfp.botconf.org/botconf-2026/talk/A3XS7T/feedback/ Amphitheater Lightning talk 2026-04-16T16:50:00+02:00 16:50 00:03 Sharing experimental approach for assessing UEFI firmware integrity on a laptop - extracting the dumped firmware PE and submitting them to MCRIT. Then proceeding on min-hashing comparison with editor's published firmware images to hunt for malicious executables. WARNING: work in progress and artisanal - not a industrialized pipeline : we used ducktape :) botconf-2026-143-lt11-using-mcrit-for-firmware-analysis-experimental-poorman-s-integrity-check-pipeline Lightning talk ARNOULD QuentinPierre-Yves LASCAUX en false https://cfp.botconf.org/botconf-2026/talk/FVCATJ/ https://cfp.botconf.org/botconf-2026/talk/FVCATJ/feedback/ Amphitheater Lightning talk 2026-04-16T16:53:00+02:00 16:53 00:03 The Latin American threat landscape is constantly evolving. The attacks range from basic consumer phishing campaigns to malware as a service offerings and beyond. In this presentation I will briefly discuss trends in the landscape, talk about common malware used by threat actors and briefly touch on interesting campaigns. Finally, I will talk about how LATAM threats reach beyond the Americas and affect Europe and beyond. botconf-2026-144-lt12-crimewars-episode-1-the-latam-menace Lightning talk /media/botconf-2026/submissions/BJXUCT/Presentation.001_5IGd8CK_uiinTE_akuHTQx.webp Jared Peck en false https://cfp.botconf.org/botconf-2026/talk/BJXUCT/ https://cfp.botconf.org/botconf-2026/talk/BJXUCT/feedback/ Amphitheater Lightning talk 2026-04-16T16:56:00+02:00 16:56 00:03 The unexpected meeting of the threat actor that was I was tracking botconf-2026-145-lt13-you-just-need-to-ask-nicely Lightning talk Victor Rocheron en false https://cfp.botconf.org/botconf-2026/talk/ZMJVTF/ https://cfp.botconf.org/botconf-2026/talk/ZMJVTF/feedback/ Amphitheater Lightning talk 2026-04-16T16:59:00+02:00 16:59 00:03 Netcraft is a cybercrime disruption company, with a world-leading takedown system, part of VT URL Scanners. For a few years we've been replying to scam emails and text messages to map uncover fraudsters infrastructure. This allows to uncover intelligence that can be used to disrupt fraudsters and protect end-citizens. In this lighting talk, we provide a brief overview of this work, before diving into a "hall of fame" best interactions we've had with the fraudsters. botconf-2026-146-lt14-flipping-the-script Lightning talk Mayeul Fournial en false https://cfp.botconf.org/botconf-2026/talk/MPPGSP/ https://cfp.botconf.org/botconf-2026/talk/MPPGSP/feedback/ Amphitheater Lightning talk 2026-04-16T17:02:00+02:00 17:02 00:03 Modern enterprise grade level fraud, spoofing Android Tv boxes as phones via virtualization/ for: residential proxying, committing social media fraud, generating ad-clicks for ad-fraud, evading modern anti-bot /fraud measures, and an entire ecosystem powered by AI and ML in both development and fraud task execution. Ongoing research so no NAMES botconf-2026-147-lt15-modern-fraud-botnet-powered-by-ai Lightning talk Pedro Falé en false https://cfp.botconf.org/botconf-2026/talk/MCLGEZ/ https://cfp.botconf.org/botconf-2026/talk/MCLGEZ/feedback/ Amphitheater Lightning talk 2026-04-16T17:05:00+02:00 17:05 00:03 What happens when a MaaS (Malware-as-a-Service) operator deploys a commercial packer like Virbox Protector to shield their Android banking trojan, but forgets to secure the rest of their operation? In this lightning talk, we walk through a real-world case where advanced anti-analysis protections initially broke our internal pipelines, only for a simple pivoting technique to reveal a debug build of the same malware, completely unprotected. From there, we fully reversed the core malware logic, uncovered an unauthenticated API endpoint leaking live botnet data, and mapped detailed infection statistics across targeted countries. The key takeaway: commercial packers can harden the payload, but they cannot patch a poorly managed botnet infrastructure. Sometimes, all it takes is thinking outside the box. botconf-2026-148-lt16-breaking-maas-in-3-minutes Lightning talk Federico Valentini en false https://cfp.botconf.org/botconf-2026/talk/M8YJ8P/ https://cfp.botconf.org/botconf-2026/talk/M8YJ8P/feedback/ Amphitheater Lightning talk 2026-04-16T17:08:00+02:00 17:08 00:03 A small talk about how good labelling of threats and malware is really helpful for analysts botconf-2026-139-lt17-good-labels Lightning talk Alexis Goodfaith en false https://cfp.botconf.org/botconf-2026/talk/N37HGZ/ https://cfp.botconf.org/botconf-2026/talk/N37HGZ/feedback/ Amphitheater Lightning talk 2026-04-16T17:11:00+02:00 17:11 00:03 Threat intelligence sharing is one of the cornerstones of the security community. Disclosing findings publicly helps defenders act, raises collective awareness, and advances the field. But sharing is not a cost-free operation and this talk is about one case where the cost became visible in an unexpected way. In early 2026, Cleafy TIR published a full technical analysis of Mirax, a novel Android RAT capable of turning infected devices into residential proxy nodes. The report included C2 indicators, malware capabilities, and delivery infrastructure details. One element was deliberately withheld: the URL of an attacker-controlled GitHub repository actively distributing new APK variants on a daily basis. The decision to blur it was intentional, the repository represented a live intelligence source, and burning it would mean losing visibility into an ongoing campaign. This talk presents that case as a concrete example of a recurring tension in threat intelligence sharing: the gap between the intent of a disclosure and the downstream actions it enables. We examine the decision to blur rather than redact, the signal that blurring carries, and what it means when that signal is not recognised or respected. The talk does not offer a verdict. It asks a question the community should be discussing openly: how do we share intelligence without becoming collateral in our own disclosures? botconf-2026-149-lt18-the-cost-of-sharing Lightning talk Alessandro Strino en true https://cfp.botconf.org/botconf-2026/talk/Z7SRXM/ https://cfp.botconf.org/botconf-2026/talk/Z7SRXM/feedback/ Reception area Long talk 2026-04-16T08:30:00+02:00 08:30 00:30 botconf-2026-108-registration Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/9QS8TB/ https://cfp.botconf.org/botconf-2026/talk/9QS8TB/feedback/ Reception area Long talk 2026-04-16T10:30:00+02:00 10:30 00:30 botconf-2026-105-coffee-break Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/K7EQL7/ https://cfp.botconf.org/botconf-2026/talk/K7EQL7/feedback/ Reception area Long talk 2026-04-16T12:30:00+02:00 12:30 01:15 botconf-2026-102-lunch Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/W9YKRX/ https://cfp.botconf.org/botconf-2026/talk/W9YKRX/feedback/ Reception area Long talk 2026-04-16T14:45:00+02:00 14:45 00:45 botconf-2026-106-coffee-break Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/BWJWR3/ https://cfp.botconf.org/botconf-2026/talk/BWJWR3/feedback/ Reception area Long talk 2026-04-16T19:00:00+02:00 19:00 03:20 botconf-2026-115-gala-reception Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/ALFNTA/ https://cfp.botconf.org/botconf-2026/talk/ALFNTA/feedback/ Amphitheater Regular talk 2026-04-17T09:30:00+02:00 09:30 00:30 Node.js has become a staple in the malware development toolkit of crimeware authors: It is easy to develop, trivial to obfuscate and difficult to analyze, with a rich ecosystem of open-source tools such as packers and obfuscators available to threat actors. This talk introduces a purpose-built, open-source Node.js Tracer designed to cut through the noise by instrumenting the runtime rather than having to deal with tedious manual source code deobfuscation, ultimately saving precious time for analysts and incident responders. After an overview on different forms of Node.js malware observable in the wild, the talk reconstructs a malware research that sparked the tool's development, outlines the mechanics of tracing as a dynamic reverse-engineering method, and demonstrates how runtime hooking exposes the malware's real behavior. Attendees will see, using case studies of several real cases, how the utility neutralizes anti-analysis checks, bypasses obfuscation and speeds up the analysis process - the result is a practical workflow for reverse engineers, malware analysts and incident response teams facing increasingly obfuscated JavaScript-based malware families. botconf-2026-30-defeating-node-js-malware-through-api-tracing Main conference Sven Rath en false https://cfp.botconf.org/botconf-2026/talk/PJGVWU/ https://cfp.botconf.org/botconf-2026/talk/PJGVWU/feedback/ Amphitheater Regular talk 2026-04-17T10:00:00+02:00 10:00 00:30 The U.S. Department of Justice reported that RapperBot's Command and Control (C2) servers have been successfully seized by the Defense Criminal Investigation Service (DCIS) on August 6, 2025 in conjunction with Operation PowerOFF. Two months before that, we took over one of 8 C2 domains of RapperBot and about 60,000 infected devices were observed as of June 2025. But that sinkhole C2 domain is no longer valid for the latest RapperBot which removed the sinkhole domains. These victim devices should be still vulnerable even after the C2 servers were powered off. Though our honeypots had been optimized for the Digital Video Recorders to obtain the RapperBot, we sometimes receive the other exploitations from the different botnets. Because RapperBot has no killer function for the competitors, the exploitation from the other botnet means the replacement of the bot. Our passive darknet monitoring system is already observing non-RapperBot scan packets from the former RapperBots. From March to October 2025, the exploitations to install the new Mirai-based malware were observed on our honeypots. The most notable point we found is that this malware family hides the own process by mounting "/proc/1" to "/proc/self". Because we couldn't find any existing report about this malware, we began to call it MountBot. We found that some DDoS attacks by MountBot exactly link AISURU botnet's attacks. Another botnet is MooBot. We found the log data on the exposed download server. It indicates that some former RapperBots were replaced with MooBot. We will present the detailed analysis results and the activities of the possible next botnets which would take over the victim devices from RapperBot. We will also show the detailed analysis results of the Mirai-based proxy peers including RapperBot and AISURU botnet. botconf-2026-51-tracking-the-next-botnets-after-the-rapperbot-s-poweroff Main conference Hideyuki Furukawa en false Botconf2026_TrackingNextBotnetAfterRapperBotsPowerOff.pdf https://cfp.botconf.org/botconf-2026/talk/NZMVQR/ https://cfp.botconf.org/botconf-2026/talk/NZMVQR/feedback/ Amphitheater Regular talk 2026-04-17T10:30:00+02:00 10:30 00:30 Kimwolf is a massive botnet first disclosed by QI-ANXIN XLab in December 2025, primarily targeting Android devices—especially TV boxes—with an estimated 1.8+ million active infected devices across 222 countries and regions worldwide. The botnet is highly versatile, featuring DDoS attacks, traffic proxying, reverse shells, and file management capabilities. In one recorded instance, it issued a staggering 1.7 billion DDoS commands over just a few days, with a potential peak attack capacity approaching 30 Tbps. The moment Kimwolf shot to fame came in October 2025, when one of its C2 domains briefly outranked tech behemoths like Google and Apple, claiming the number one spot on Cloudflare's global popularity chart. Kimwolf conceals its C2 domain resolution using DNS over TLS (DoT) and employs elliptic curve digital signatures (ECDSA) for robust C2 server authentication, ensuring bots only accept commands from legitimate sources. After repeated infrastructure takedowns by security researchers and third parties, its operators adopted the EtherHiding technique, leveraging blockchain-based domains such as Ethereum Name Service (ENS) to significantly boost C2 resilience against disruption. Additionally, technical analysis reveals extensive code and infrastructure overlap between Kimwolf and the notorious Aisuru botnet — holder of the world record for largest DDoS attack — strongly indicating that both are controlled by the same threat actor group. This presentation details the full story of the analysis and ongoing battle against the Kimwolf botnet. We will dive into the technical specifics, share behind-the-scenes insights and provide the first detailed public breakdown of its infection and propagation chain. botconf-2026-63-the-howl-of-kimwolf-resonates-across-1-8-million-android-devices-worldwide Main conference Alex TuringWang HaoAcey9 en false https://cfp.botconf.org/botconf-2026/talk/D9LLZ3/ https://cfp.botconf.org/botconf-2026/talk/D9LLZ3/feedback/ Amphitheater Regular talk 2026-04-17T11:30:00+02:00 11:30 00:30 TA410 is a cyber-espionage umbrella group consisting of three subgroups: FlowingFrog, LookingFrog, and JollyFrog. TA410 activity has been observed since 2018, targeting a diverse range of sectors. FlowCloud is a toolset exclusively used by FlowingFrog. One interesting point is that a HUMINT-driven technique was used for initial access: using a USB device to deliver and install FlowCloud. The name “FlowCloud” has often been used to refer to the RAT because the string “FlowCloud” appears in its configuration data and PDB strings. However, based on our analysis of samples and PDB strings, we believe FlowCloud is actually the name of a finely crafted attack framework, specifically an MSVC solution containing multiple projects beyond the RAT itself, including a loader, a rootkit driver, and an installer, uninstaller. The FlowCloud solution consists of two primary RAT components: fcClient and hcClient. These RATs are sophisticated C++/C applications and have common application designs: encryption algorithms, extensive use of Google Protocol Buffer for C2 communication data formats and configuration, communicating with two external servers (exchange_server and file_server). fcClient has a more structured C++-based design, whereas hcClient is a C-based application. Previously, fcClient and hcClient were categorized under the FlowCloud RAT. However, our analysis reveals that they are distinct, yet related RATs with separate development paths. We have continued tracking the FlowCloud toolset and identified two new FlowCloud RATs, which are updated versions of hcClient: FlowCross (v5.0.5dz) and FlowThrough (v7.0.0). In this presentation we will provide in-depth details on the long-term used twin RATs (fcClient and hcClient). Especially, we will do deep dive into: - New FlowCloud tools, which have not been publicly documented - Parsing and extracting Protocol Buffers messages from fcClient and hcClient - Deobfuscation of hcClient payload, including a live demo botconf-2026-32-dissecting-evil-twin-rats-tracking-the-long-term-use-of-ta410-s-flowcloud-toolset Main conference Hiroshi Takeuchi en false https://cfp.botconf.org/botconf-2026/talk/AJ997A/ https://cfp.botconf.org/botconf-2026/talk/AJ997A/feedback/ Amphitheater Regular talk 2026-04-17T12:00:00+02:00 12:00 00:30 Over the past years, we closely monitored and tracked the evolution of FrostyNeighbor, also known as UNC1151. Aligned with the interests of an Eastern European country, this APT group has demonstrated since 2016 technical sophistication and strategic intent, mixing cyberespionage with political influence operations, highlighting how this group evolved from targeting military and governmental entities to interfering in democratic processes. Initially focused on intelligence collection against Ukrainian defense and governmental organizations, the group expanded its scope to other countries, aligning its operations with geopolitical interests, like the Polish parliamentary elections in 2023 and presidential election in 2025. The group uses spearphishing and credential theft alongside narratives to shake up public opinion on sensitive political issues. FrostyNeighbor has continually refined its methods to thwart defenders. Over time, it went from relatively simple lure documents to complex compromise chains, using custom malware implemented in multiple programming languages. Its modular toolset enabled FrostyNeighbor to deliver payloads only to selected targets, hidden inside seemingly benign files such as images or style sheets. The group also ran many phishing campaigns, using spoofed login pages to target victims, and by exploiting vulnerabilities in widely used webmail platforms, notably Roundcube. This dual approach, espionage for strategic advantage and political disruption to sow discord, highlights the growing complexity of modern cyberconflict. FrostyNeighbor’s operations illustrate how state-linked threat actors exploit digital ecosystems not only to steal secrets but also to shape narratives and erode trust in democratic institutions. In this presentation, we describe the most interesting tools in FrostyNeighbor’s arsenal, including advanced compromise chains and multistage malware. Finally, we highlight the group’s victimology and post-compromise activities. botconf-2026-36-frostyneighbor-s-playbook-how-phishing-and-malware-drive-long-term-espionage-in-europe Main conference Damien Schaeffer en false https://cfp.botconf.org/botconf-2026/talk/ZQG8K3/ https://cfp.botconf.org/botconf-2026/talk/ZQG8K3/feedback/ Amphitheater Regular talk 2026-04-17T12:30:00+02:00 12:30 00:30 Sometimes, you disrupt a massive fraud operation only for it to return bigger and stronger two years later. That's what HUMAN Security found with the successor to the original BADBOX campaign. BADBOX 2.0 targets millions of victims with more backdoor variants, more fraud schemes, and more sophistication than ever before. The China-based threat actors created an entire fraud ecosystem, infecting over 1 million consumer devices with a backdoor in over 200 countries and territories. BADBOX 2.0 is the largest botnet of infected connected TV devices ever uncovered and represents a significant evolution in cybercrime in which multiple types of fraud co-occur. This talk will dive into all of the details of BADBOX 2.0, including its interconnected nature, how threat actors target the entire customer journey, and how it can be impossible to thwart crimes like this without proper protection. HUMAN’s Satori Research team will present the technical intricacies, including the backdoor techniques, infection vectors, monetization strategies, and the infrastructure that enabled threat actors to hijack millions of devices worldwide, in addition to BADBOX’s implications for the Internet and how the company worked to stop it. We will also provide an update about what happened after the report was released, including how the takedown has progressed. botconf-2026-11-when-your-ctv-box-goes-rogue-how-millions-were-tricked-into-aiding-a-global-cybercrime-operation Main conference Lindsay KayeVikas ParthasarathyJoao Santos en false https://cfp.botconf.org/botconf-2026/talk/WVDLSU/ https://cfp.botconf.org/botconf-2026/talk/WVDLSU/feedback/ Amphitheater Long talk 2026-04-17T14:00:00+02:00 14:00 00:30 Ransomware negotiation portals have traditionally been hosted as Tor hidden services or on bulletproof VPS infrastructure. While resilient, these systems remain dependent on hosting providers and therefore vulnerable to seizure and disruption. cry0 has begun shifting this model by deploying victim negotiation and payment portals on the Internet Computer Protocol (ICP) using WebAssembly-based canisters. Rather than renting servers, operators deploy application logic into a distributed execution environment replicated across a decentralized node network. This talk presents a technical analysis of cry0’s observed on-chain portal deployment and examines the architectural properties that enable it. Because ICP canisters execute deterministic Wasm code with persistent replicated state and web-accessible interfaces, they function as consensus-governed application runtimes rather than static hosting platforms. We first reconstruct cry0’s use of ICP for victim-facing infrastructure. We then analyze what this execution model structurally enables, including embedded negotiation workflows, automated payment validation logic, resilient portal replication, and large-scale encrypted data hosting. Finally, we evaluate how this shift alters the disruption model for ransomware infrastructure. When extortion control planes execute inside consensus-replicated environments, seizure becomes a protocol and governance challenge rather than a hosting problem. The session concludes with a defender-focused framework for identifying, tracking, and responding to blockchain-hosted ransomware infrastructure. botconf-2026-124-unseizable-extortion-cry0-s-use-of-the-icp-blockchain Sprint CFP /media/botconf-2026/submissions/8XJHEV/1767477248121_5T1dzfy_MGjWqS0.webp Tammy Harper en false https://cfp.botconf.org/botconf-2026/talk/8XJHEV/ https://cfp.botconf.org/botconf-2026/talk/8XJHEV/feedback/ Amphitheater Regular talk 2026-04-17T14:30:00+02:00 14:30 00:30 Silver Fox, first observed in 2024, has quickly grown into a major cyber threat, initially targeting Chinese-speaking users. The group employs a wide range of techniques, including targeted phishing, SEO poisoning, and the distribution of trojanized software. Unlike actors focused solely on RAT deployment, Silver Fox operates as a hybrid threat, combining cyber espionage with criminal objectives such as deploying custom malware, stealing credentials, and installing tools for persistent remote access. Our investigation in early 2025 uncovered attacks using the Winos malware against users in Taiwan. Further analysis revealed these incidents were part of a larger, coordinated campaign affecting multiple Asian regions. Notably, Silver Fox demonstrates versatility in its tool selection. In addition to custom malware like Winos and HoldingHands, the group has started abusing legitimate Remote Monitoring and Management (RMM) software to carry out data theft. These signed RMM tools, normally used for IT administration, give attackers a layer of credibility that helps them avoid detection. By blending malicious activity with trusted applications, Silver Fox can bypass standard security controls and operate under the radar. This presentation offers a comprehensive technical investigation into the Silver Fox campaign, dissecting their attack chains, analyzing the behavior of RAT tools, and detailing the execution patterns of commercially available RMM software. By correlating infrastructure across related clusters, we reveal valuable insights for defenders, including key indicators and patterns to facilitate early detection. This presentation concludes with a discussion of persistent patterns in Silver Fox’s infrastructure and tool selection, aiding in accurate attribution and proactive threat hunting initiatives. botconf-2026-29-malicious-blind-pack-uncovering-all-rat-tools-in-silver-fox-campaign Main conference Yi Ping (Cara) LinRachael Liao en false https://cfp.botconf.org/botconf-2026/talk/JZWWS8/ https://cfp.botconf.org/botconf-2026/talk/JZWWS8/feedback/ Amphitheater Regular talk 2026-04-17T15:00:00+02:00 15:00 00:30 In November 2025, our Threat Hunting team identified a low-volume credential stuffing campaign targeting authentication attempts associated with the Microsoft Azure PowerShell application in Entra ID. While these attempts were largely unsuccessful due to enforced MFA, the request patterns strongly resembled activity previously associated with the Quad7 botnet. The purpose of this presentation is to disclose details of our ongoing investigation that pivoted from cloud-based authentication abuse to compromised embedded devices, uncovering multiple botnet components and distinct actor activity on real-world customer-owned hardware. We identified a shared embedded-device ecosystem in which at least two independent actors operated in parallel: one aligned with previously documented Quad7 activity, and another leveraging compromised devices as residential proxy and ORB infrastructure. This overlap illustrates how mass-compromised network devices blur traditional distinctions between state-aligned operations and eCrime-driven proxy ecosystems. At the time of writing, we are not aware of any prior public disclosure of these findings. botconf-2026-84-when-one-botnet-leads-to-another-pivoting-from-quad7-like-activity-to-unknown-proxy-networks-on-embedded-devices Main conference Andreas PetkerHanno Heinrichs en false https://cfp.botconf.org/botconf-2026/talk/AX8BTL/ https://cfp.botconf.org/botconf-2026/talk/AX8BTL/feedback/ Amphitheater Regular talk 2026-04-17T15:30:00+02:00 15:30 00:30 This proposal describes the discovery and analysis of Izanagi RAT, a low-prevalence Go-based backdoor, which likely originates from a China-Nexus threat actor. The malware was discovered recently during an incident response engagement and was active in the victim’s environment since June 2021. Exceptionally long dwell time and initial lack of intelligence about this malware strain sparked our interest and led to further analysis and reverse engineering. Although Izanagi RAT may overlap with the malware family Zingdoor previously described by Trend Micro, technical details about this malware have, to the best of our knowledge, never been published before. As of December 2025, none of the samples we analyzed have meaningful detections or signature matches in VirusTotal, other analysis engines or OSINT indicators and signatures. Furthermore, our work shows that the origins of this malware family can be traced back further than previously reported by Trend Micro. The talk we intend to give at Botconf will not only provide a detailed insight into the technical details of Izanagi RAT, such as for example various anti-analysis techniques and a multi-protocol C2 communication scheme, but also showcase the methodology and tools used to derive these results. botconf-2026-80-izanagi-rat-discovery-and-analysis-of-a-cross-platform-long-lived-go-backdoor Main conference Fabian Marquardt en false https://cfp.botconf.org/botconf-2026/talk/YYRQYQ/ https://cfp.botconf.org/botconf-2026/talk/YYRQYQ/feedback/ Amphitheater Long talk 2026-04-17T16:00:00+02:00 16:00 00:15 botconf-2026-112-closing-speech Animation en false https://cfp.botconf.org/botconf-2026/talk/RJSHDV/ https://cfp.botconf.org/botconf-2026/talk/RJSHDV/feedback/ Reception area Long talk 2026-04-17T09:00:00+02:00 09:00 00:30 botconf-2026-109-registration Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/3AQXSK/ https://cfp.botconf.org/botconf-2026/talk/3AQXSK/feedback/ Reception area Long talk 2026-04-17T11:00:00+02:00 11:00 00:30 botconf-2026-116-coffee-break Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/KEA7J9/ https://cfp.botconf.org/botconf-2026/talk/KEA7J9/feedback/ Reception area Long talk 2026-04-17T13:00:00+02:00 13:00 01:00 botconf-2026-103-lunch Networking & breaks en false https://cfp.botconf.org/botconf-2026/talk/78HGNV/ https://cfp.botconf.org/botconf-2026/talk/78HGNV/feedback/