BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.botconf.org//botconf-2026//talk//8XJHEV
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-botconf-2026-8XJHEV@cfp.botconf.org
DTSTART;TZID=CET:20260417T140000
DTEND;TZID=CET:20260417T143000
DESCRIPTION:Ransomware negotiation portals have traditionally been hosted a
 s Tor hidden services or on bulletproof VPS infrastructure. While resilien
 t\, these systems remain dependent on hosting providers and therefore vuln
 erable to seizure and disruption.\ncry0 has begun shifting this model by d
 eploying victim negotiation and payment portals on the Internet Computer P
 rotocol (ICP) using WebAssembly-based canisters. Rather than renting serve
 rs\, operators deploy application logic into a distributed execution envir
 onment replicated across a decentralized node network.\nThis talk presents
  a technical analysis of cry0’s observed on-chain portal deployment and 
 examines the architectural properties that enable it. Because ICP canister
 s execute deterministic Wasm code with persistent replicated state and web
 -accessible interfaces\, they function as consensus-governed application r
 untimes rather than static hosting platforms.\nWe first reconstruct cry0
 ’s use of ICP for victim-facing infrastructure. We then analyze what thi
 s execution model structurally enables\, including embedded negotiation wo
 rkflows\, automated payment validation logic\, resilient portal replicatio
 n\, and large-scale encrypted data hosting.\nFinally\, we evaluate how thi
 s shift alters the disruption model for ransomware infrastructure. When ex
 tortion control planes execute inside consensus-replicated environments\, 
 seizure becomes a protocol and governance challenge rather than a hosting 
 problem. The session concludes with a defender-focused framework for ident
 ifying\, tracking\, and responding to blockchain-hosted ransomware infrast
 ructure.
DTSTAMP:20260429T222318Z
LOCATION:Amphitheater
SUMMARY:Unseizable Extortion: cry0’s Use of the ICP Blockchain - Tammy Ha
 rper
URL:https://cfp.botconf.org/botconf-2026/talk/8XJHEV/
END:VEVENT
END:VCALENDAR