3010, 2026

DeepSec 2026 Talk: Before the Breach: Proactive Hunting in the Age of AI-Assisted Attacks – Joey Chen

Sanna/ October 30, 2026/ Conference/ 0 comments

Traditional threat research usually begins after the damage starting from a malware sample or post-incident forensics. We flipped the model. By pro-actively monitoring Command-and-Control (C2) infrastructure before it became operational, we gained an unprecedented front-row seat to how modern threat actors build, automate, and scale their operations. Over a year of continuous tracking, we collected 8+ TB of intelligence by monitoring potential C2 infrastructure and harvesting artefacts from exposed open directories. Combined with our BadIIS threat hunting strategy, this approach enabled us to uncover a global malicious SEO threat actor responsible for targeting over 170,000 victims worldwide and to reconstruct their entire operational workflow, from setup to exploitation. During this investigation, we observed two major findings. First, the actor’s toolchain offers a glimpse into the future of offensive automation: Metasploit, Cobalt Strike, DeepAudit, and

2910, 2026

DeepSec 2026 Talk: Forget your Firewalls – SAP Supply Chain Attacks – Andreas Wiegenstein

Sanna/ October 29, 2026/ Conference/ 0 comments

Almost all companies that run SAP also run add-ons. Yet practically none of them perform adequate security analysis of their third-party solutions. They operate many external code programs on their networks without ever inspecting them for risks. This presentation is backed by analysis data from over 100 companies and a long list of critical vulnerabilities in add-ons, ranging from those of small vendors to market leaders, security solution providers, and ‘Big 4’ financial auditing firms. The talk explains why companies running SAP currently have a severe blind spot, and what could happen if ABAP-based malware were to infiltrate their SAP landscape, based on insights gained from several simulated malware infiltration projects involving major companies in Germany. Some of the details to be discussed are: Common security defects in third-party solutions; Backdoors in third-party solutions;

2810, 2026

DeepSec 2026 Talk: Damage Control: the Gap between Assumed and Actual Control Coverage across Enterprise Estates – Lucy Caiger

Sanna/ October 28, 2026/ Conference/ 0 comments

Every security team keeps score with control coverage numbers; how much of the estate has endpoint protection? Or how many assets are patched inside SLA? As an operator, you need those numbers to be right: they decide where remediation effort goes, and they’re the evidence behind every assurance you pass upward. But each number rests on an assumption you rarely get to test – that reported coverage is actual coverage. When it isn’t, you’re exposed without knowing where. In this session, I’ll start with your assumed coverage, comparing it against real-world enterprise data. The gap is usually wider than expected, but what turns it into real exposure is where it sits. Because a standard coverage metric counts every gap the same and assumes they are unrelated. But that’s not how an attacker experiences an

2710, 2026

DeepSec 2026 Talk: Like the back of your hand… – Mattias Jacobsson

Sanna/ October 27, 2026/ Conference/ 0 comments

How well do you think you know your environment? Are you prepared for, and know what to do when an incident comes along? If not, a good idea would be to get ready by practising, but how? This presentation gives you a glimpse into how you can take advantage of CDXE when building yourself a realistic exercise environment for your company’s cyber defence exercise needs. CDXE is an all-in-one internet-like environment that helps you set-up the internet part of your air-gapped exercise environment with low resource requirements. We do also get into other use cases, like how teachers could use CDXE to help students learn about the inner working of the internet. Expect a wild ride into the unknown of virtualising the internet and how that can be useful for a wide range of

2610, 2026

DeepSec 2026 Talk: Genericpocalypse: Fixing macOS Malware Identification with ML – Kseniia Yamburh & Nazar Grycshuk

Sanna/ October 26, 2026/ Conference/ 0 comments

The macOS threat landscape is growing fast, yet identification lags: roughly 70% of macOS samples on VirusTotal carry labels like “Generic Trojan” or “Generic Agent”, giving SOC teams almost nothing actionable to work with. Manual triage can drag on for days, and sandbox evasion by modern macOS malware makes automated analysis even harder. In this talk, we present a practical, layered approach that turns “Generic” into something useful. First, we introduce The Eye – an in-house ML-powered tool that clusters macOS binaries by combining byte-level patterns, entropy, Symhash, Ssdeep, Bundle IDs, Team IDs, and a custom YARA-like rule-set. The clustering engine groups similar samples automatically and ranks collections by potential danger, prevalence, so that analysts immediately know what to investigate first. Second, we unveil SWARM – a Mach-O feature-based detection rule-set mapped to macOS

2310, 2026

DeepSec 2026 Talk: Damage Report: What Breaks When LLM Agents Run Your SOC – Aysel Rahimli

Sanna/ October 23, 2026/ Conference/ 0 comments

We gave LLM agents real access to a working SOC (the systems teams actually use every day for detection, endpoint response, threat intel, and email security) and let them investigate alerts, pull in context, and take action, always with a human approving the final step. This talk is my honest report of what went wrong. Some of it was uncomfortable. Agents told us an action had succeeded when it never ran. They claimed to have analyzed “all events” after seeing only the first page of results. When an alert ID didn’t exist, instead of saying so, they quietly picked a similar-looking one and carried on. Sometimes the framework itself failed and printed a tool call as plain text instead of executing it. And a single “proceed” from a user could send the whole thing

2210, 2026

DeepSec 2026 Talk: Your Traffic Is Lying to You – How Layer 7 Attacks and Bot Campaigns Hide in Plain Sight – Lisa Froehlich

Sanna/ October 22, 2026/ Conference/ 0 comments

Bots generate more than half of all global HTTP traffic. Most of these bots are designed to appear legitimate. This talk examines how modern Layer 7 attacks and bot campaigns operate below every threshold your monitoring system is calibrated for and explores what actually stops them. The core problem is not technical sophistication. Rather, it is the absence of a behavioural baseline. Organizations that have never profiled their legitimate traffic cannot distinguish a bot campaign from a demand spike. Traffic volume, unique IP counts, and request rates have become unreliable indicators, and attackers know it. This talk presents four real attack scenarios from production network operations, traces the available but missed detection signals, and explains what behavioural detection must do and where it falls short. All cases were mitigated, making the defence decisions and

2210, 2026

DeepSec 2026 Training: Automating LLM-powered Security Operations – Josh Pyorre

Sanna/ October 22, 2026/ Training/ 0 comments

Security operations are full of repetitive, high-volume work: triaging alerts, processing threat intel, scraping vendor advisories, analyzing malware reports, generating detection rules, writing incident summaries. Most of this work could be automated. This workshop will teach attendees to combine LLM reasoning with durable workflow orchestration to solve the specific problems that exhaust security teams: automatically extracting IOCs from threat intel pages, generating detection rules from malware reports, classifying and triaging batches of alerts, and escalating true positives to an automated response workflow, all without human intervention. Over the course of the workshop, attendees will build and run: A threat intelligence scraper that fetches and parses public intel sources and uses an LLM to extract structured IOCs A malware report processor that reads email-based threat reports and generates Suricata/Snort detection rules via LLM An alert

2010, 2026

DeepSec 2026 Talk: Quantum Communication – Andreas Neuhold

Sanna/ October 20, 2026/ Conference/ 0 comments

Quantum computers will break the encryption we rely on today, and the clock is ticking. But what does that actually mean, and what can you do about it right now? This talk starts from the ground up, giving attendees an accessible introduction to the two quantum-safe building blocks: Post-Quantum Cryptography (PQC), a mathematical software-based replacement for classical key exchange, and Quantum Key Distribution (QKD), a physics-based approach that uses quantum optical channels to distribute keys with information-theoretic security. This talk cuts through the hype and delivers a technically grounded, practitioner-focused view of what quantum-safe communication actually means in 2026 and what you can deploy right now. Whether you are a security engineer, network architect, or technical decision-maker, this session provides the concrete technical foundation needed to assess, plan, and implement quantum-resistant communication today. We

1910, 2026

DeepSec 2026 Press Release: Physical Security Controls as a Universal Vulnerability

Sanna/ October 19, 2026/ Press, Training/ 0 comments

When security controls in the physical world fail, attacks are often much harder to detect. Many companies are now seeking certification to standards as part of supplier assessments and in response to higher security requirements. The ISO 27001 standard, for example, is a route many organisations are taking. Physical controls are also required as part of its implementation. DeepSec 2026 will introduce a three-day workshop that demonstrates how to bypass Physical Access Control Systems (PACS). Anyone who still thinks of analogue lock-picking is underestimating the seriousness of the situation. The specialist trainers will demonstrate how to bypass commercially available access systems on the European market. The focus will be primarily on the hardware, software, and access tokens used, such as cards or other data carriers. Bypassing Access Control Systems Physical access to infrastructure is

1910, 2026

DeepSec 2026 Talk: I Own Your “Internal” Domain… Weaponizing Name Collisions at Scale – Philippe Caturegli

Sanna/ October 19, 2026/ Conference/ 0 comments

What happens when someone else actually registered and operated your internal domain name? You leak credentials. Email gets mis-routed, deployment pipelines pull code from untrusted places, and most of the time, you don’t even notice for years. With over 1,200 new TLDs introduced over the past decade, many organisations are unknowingly using internal domain names that now exist as valid, publicly registerable FQDNs that they don’t own and never thought to claim. Name collision itself is not new. Researchers have documented it as a theoretical risk since 2013. But no one has studied it at scale, or answered simpler questions: how could threat actors identify a potential collision, and what would be the impact if they claimed a colliding domain and operated it ? We analysed nearly 39 million SSL certificates and over 9.5

0810, 2026

DeepSec 2026 Talk: Security, Trust & Privacy by Design for Smartphone Solutions – Kartik Lalan

Sanna/ October 8, 2026/ Conference/ 0 comments

Lacking security standardization in terms of usage policies, smartphones solutions are being poorly designed compromising end user’s data. Also lack of thorough risk management while developing such solutions leads to uncalculated risks emerging out of the platform. In this talk we will be discussing on drawing risk boundaries, so that making any smartphone based Solution, manufacturers and end users can achieve real data security and transparency. For instance, Very often we see solutions using additional fingerprint reader capturing raw images outside OS TEE despite beyond the promise of OS security e.g. user national identity program, using location service for security & safety solutions but those can be manipulated even without jail-breaking/rooting a device e.g. Covid’19 apps or banking or logistics etc., Payment POS without kiosk hardening which allows anyone use it fraudulently to phish

0710, 2026

DeepSec 2026 Talk: Keeping OT Insecure: A Masterclass on How To Make Hackers Happy – Melina Phillips

Sanna/ October 7, 2026/ Conference/ 0 comments

Did it ever happen to you as a kid, you’d see a machine, a switch, or a big shiny button, and you just had to know… “What happens if I press this?” Well, hackers never grow out of that phase. Except instead of breaking a toy, they poke at devices that control factories, power grids, HVAC infrastructure, alarm systems and really important stuff, and sometimes, we don’t even have to press a button. The system just hands us the keys like, “there you go, have fun”. To make matters worse, many of these environments were never designed keeping adversarial activity in mind. They were built to keep operations running, not to survive curious people, internal misuse, exposed interfaces, or attackers who understand how to abuse trust. In a lot of OT environments, convenience quietly

0610, 2026

DeepSec 2026 Talk: Connected, Tracked, Exposed: Threat Modeling a Production GPS Fleet Platform – Maria Afonina

Sanna/ October 6, 2026/ Conference/ 0 comments

A GPS fleet platform is a fleet of embedded devices in the field, a link over somebody else’s network, and a cloud back-end holding the location history of real vehicles and real people. Its customers in transport and logistics are increasingly subject to NIS2 obligations, which turns the vendor’s security posture into a contractual matter, so a weakness in the tracker is no longer just a technical bug, it is a compliance and procurement problem for everyone downstream. This talk walks through a structured threat modelling exercise built around a production GPS fleet management platform, conducted as part of an MSc thesis collaboration between KTH Royal Institute of Technology, the University of Trento and an Italian IoT company. We decompose the attack surface across three layers: the tracking device, the device-to-backend channel, and the

0210, 2026

DeepSec 2026 Press release: Security Vulnerabilities in Software

Sanna/ October 2, 2026/ Press/ 0 comments

Everyone is talking about Anthropic’s Mythos model. At its core, however, lies quality assurance, as always. The AI startup Anthropic has been pulling out all the marketing stops and has partially unveiled its new Mythos model. The company has promoted its benefits by highlighting the discovery of new security vulnerabilities, while also issuing warnings about the model. As expected, the media coverage has hailed the model and predicted the end of IT security. The DeepSec security conference has been focusing on new technologies for years and subjects them to rigorous testing. The Mythos model is no exception. Improved IT security Those responsible for securing digital infrastructure have long dedicated their efforts to improving existing software code and testing applications for security vulnerabilities. Key projects in the free and open-source software communities, in particular, have

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this: