Virus Bulletin

336 talks · 2014–2023 · indexed by Breach Arc Archive. Links open each talk on YouTube.

• Lazarus campaigns and backdoors in 2022 2023 - Peter Kálnai (ESET) 2023
• The global state of scams in 2023 - Jorij Abraham (GASA) 2023
• Unveiling activities of Tropic Trooper 2023 deep analysis of Xiangoop Loader and EntryShell payload 2023
• Back in BlackEnergy: 2014 targeted attacks in the Ukraine and Poland 2014
• .NET malware dynamic instrumentation for automated and manual analysis
• 2,000 reactions to a malware attack – accidental study
• 2030: backcasting the potential rise and fall of cyber threat intelligence
• A deep dive into iPhone exploit chains
• A deep dive into Water Roc, one of the most relentless ransomware groups
• A detailed analysis of a new version of Darkside Ransomware (V. 2.1.2.3)
• A new open-source hypervisor-level malware monitoring and extraction system [...]
• A quantitative examination of the current state of corporate security practices
• A study of Machete cyber espionage operations in Latin America
• A vine climbing over the Great Firewall: a long-term attack against China
• Absolutely routed!! Why routers are the new bullseye in cyber attacks
• Abusing Electron based applications in targeted attacks Jaromir Horejsi (Trend Micro)
• Abusing third-party cloud services in targeted attacks
• Advanced Pasta Threat: mapping threat actor usage of open-source offensive security tools
• Adware is just malware with a legal department...
• AI-based digital evidence enhancement technology for profiling attack groups and techniques
• All roads lead to Rome: the Conti manual leak dissection
• An automatic analysis and detection tool for Java exploits
• An in-depth analysis of abuse on Twitter
• Analysing compiled binaries using logic
• Analysis of Android in-app advertisement kits
• Anatomy of an attack: detecting and defeating CRASHOVERRIDE
• Anchor, Bazar, and the Trickbot Connection
• Android app deobfuscation using static-dynamic cooperation
• Android packer: facing the challenges, building solutions
• Android ransomware: turning CryptoLocker into CryptoUnlocker
• Android reverse engineering tools: not the usual suspects
• Android stalkerware: hunting automation, analysis and detection
• Anonymity is king
• Another threat actor day…
• Anti-malware Testing Undercover
• Applied one-to-many code similarity analysis using MCRIT - Daniel Plohmann (Fraunhofer FKIE)
• APT cases exploiting vulnerabilities in region-specific software
• APT Reports and OPSEC Evolution, or: These Are Not the APT Reports You Are Looking For
• Attack on the drones: security vulnerabilities of unmanned aerial vehicles
• Attack points in health apps & wearable devices - how safe is your quantified self?
• Attack surface analysis of Tizen devices
• Attor: spy platform with curious GSM fingerprinting
• Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers
• Back channels and bitcoins: ZeroAccess' secret C&C communications
• Battlefield Ukraine: finding patterns behind summer cyber attacks
• Behind the Black Mirror: Simulating attacks with mock C2 servers
• Behind the scenes of the SamSam investigation
• Beyond lexical and PDNS: using signals on graphs to uncover online threats at scale
• BGP - From Route Hijacking to RPKI: How Vulnerable is the Internet?
• Bootkits: past, present & future
• Botception: hire a botnet to spread one's own botnet
• Breaking the bank(er): automated configuration data extraction for banking malware
• Browser attack points still abused by banking trojans
• Bugs in malware – uncovering vulnerabilities found in malware payloads
• Buhtrap metamorphosis: from cybercrime to cyber espionage
• Building a cybersecurity AI dataset for a secure digital society - Bomin Choi (KISA)
• Building a Local PassiveDNS Capability for Malware Incident Response
• Building a malware lab in the age of Big Data
• Business Email Compromise – Scalable Attribution Powering Industry and Law Enforcement Collaboration
• C&C-as-a-Service: abusing third-party web services as C&C channels
• C2F2 a framework for detecting C2 frameworks at scale - Oleg Boyarchuk & Stefano Ortolani (VMware)
• Can we trust a trustee? An in-depth look into the digitally signed malware industry
• Caphaw - the advanced persistent pluginer
• Catch me if you can: detection of injection exploitation by validating query and API integrity
• Chasing the Digital Pirates: Unveiling the Container Threats
• Clandestine hunter: two strategies for supply chain attack
• Client Maximus raises the bar
• Closing Keynote: Threatscaping like a CERT
• Compromising IOT C&C Panels for Unearthing Infections
• Consequences of bad security in health care
• Context Aware Detection: The future of cybersecurity?
• Creating Network Effects: Intelligence Sharing for Supply Chain Security
• Crypton - exposing malware's deepest secrets
• CTO (Call Tree Overviewer): yet another function call tree viewer
• Cyber espionage in the Middle East: unravelling OSX.WindTail
• Dancing samba with Dolphins: tracking a Brazilian threat actor moving to Europe
• Dancing the night away with named pipes - Daniel Stepanic (Elastic)
• Dare 'DEVIL': beyond your senses with Dex Visualizer
• DDoS trojan: a malicious concept that conquered the ELF format
• Dead and buried in their crypts: defeating modern ransomware
• Debugging and Monitoring Malware Network Activities with Haka
• Defeating APT10 compiler-level obfuscations
• Defeating Sandbox Evasion: How to Increase Successful Emulation Rate in your Virtualized Environment
• Deobfuscating virtualized malware using Hex Rays Decompiler - Georgy Kucherin (Kaspersky)
• Design to discover: security analytics with 3D visualization engine
• Different ways to cook a Crab...
• Digital 'Bian Lian' (face changing): the skeleton key malware
• Discretion in APT: recent APT attack on crypto exchange employees
• Dissecting fleeceware apps: the million-dollar money-making machine in Android and iOS
• DMARC - how to use it to improve your email reputation
• DNS on FIre
• DNS takeover the full journey and redemption - John Jensen (Silent Push)
• DNSSEC - how far have we come?
• Does prevalence matter? Ranking anti-malware products by potential victim impact
• Doing more with less: a study of file-less infection attacks
• Domestic Kitten: an Iranian surveillance program
• Don't flatten yourself restoring malware with Control Flow Flattening obfuscation - Geri Revay
• Draw me like one of your French APTs – expanding our descriptive palette for digital threat actors
• Duping the machine - malware strategies, post sandbox detection
• Early launch Android malware: your phone is 0wned
• Economic sanctions on malware
• Effectively testing APT defences
• Emerging trends in malware downloaders
• Emissary (Pandas) in the Middle East
• Endpoint security checkbox: a stealthy approach to cyberdefence
• Everything happens for a reason the choices made by ransomware operators - Jono Davis (PwC)
• Evolution after prosecution: Psychedelic APT41
• Evolution of Android exploits from a static analysis tools perspective
• Evolution of Excel 4.0 Macro Weaponization
• Exploring Emotet, an elaborate everyday enigma
• Exploring the Chinese DDoS landscape
• Exploring the efficacy of community-driven TI: a real world approach - Samir Mody & Hariharan S (K7)
• Exploring the virtual worlds of advergaming
• Fake News, Inc.
• Fantastic information and where to find it: a guidebook to open-source OT reconnaissance
• Finding drive-by rookies using an automated active observation platform
• FirePeony a ghost wandering around the Royal Road - Rintaro Koike & Shogo Hayashi
• Fireside Chat: Comfortably Numb
• Flashback OS X malware - VB2012 presentation by Broderick Aquilino (F-Secure)
• Foreverdays: tracking and mitigating threats targeting civil society orgs
• From Asia with love? Smartphones with pre-installed malware
• From drive-by download to drive-by mining: understanding the new paradigm
• From Hacking Team to hacked team to…?
• From match fixing to data exfiltration – a story of Messaging as a Service (MaaS)
• Generic script emulation - Kurt Natvig (Acronis)
• Geost botnet. The discovery story of a new Android banking trojan from an OpSec error
• German Angst : Cybercrime Ecosystem in the DACH Region
• Getting Duped: Piggybacking on Webcam Streams for Surreptitious Recordings
• Ghost Mach-O: an analysis of Lazarus’ Mac-malware innovations
• Great Crypto Failures
• GuLoader? No, CloudEyE. Flattening the attack curve of the top malicious dropper
• Gábor Szappanos wins fourth Peter Szőr Award
• Hacking Team and Gamma International in 'business-to-government malware'
• Hidden risks of advertisements
• Hide'n'Seek: an adaptive peer-to-peer IoT botnet
• Hiding the network behind the network. Botnet proxy business model
• Hit the bullseye detecting browser exploits abusing the X memory in WebAssembly - Edouard Bochin
• How they're getting the data out of your network
• How to test properly: comparative web filter tests
• Hunting web skimmers with VirusTotal and YARA
• Hypervisor-based, hardware-assisted system monitoring
• Industroyer: biggest threat to industrial control systems since Stuxnet
• Infostealers investigate the cybercrime threat in its ecosystem - Livia Tibirna & Pierre Le Bourhis
• Inside Magecart: the history behind the covert card-skimming assault on the e-commerce industry
• Intent-based approach to detect email account compromise - Abhishek Singh & Fahim Abbasi (Cisco)
• Internet balkanization: why are we raising borders online?
• It has a EULA, it must be legit
• It's a file infector... it's ransomware... it's Virlock
• Just in time, deception to detect Credential Stuffing Bot
• Keynote address: One man's anti-malware researcher is...
• Keynote address: Solving cyber insecurity - Martin Lee (Cisco Talos)
• Keynote address: The physics of information asymmetry - Juan Andrés Guerrero Saade (SentinelOne)
• Keynote address: The security products we deserve
• King of the hill: nation-state counterintelligence for victim deconfliction
• Labeless - no more
• Labelling spam through the analysis of protocol patterns
• Last-minute paper: A Malicious OS X Cocktail Served from a Tainted Bottle
• Last-minute paper: FinFisher: New techniques and infection vectors revealed
• Last-minute paper: Operation Potao Express: analysis of a cyber-espionage toolkit
• Last-minute paper: Spora: the saga continues a.k.a. how to ruin your research in a week
• Last-minute paper: The mysterious case of Linux.Wifatch
• Lazarus Group: one mahjong game played with different sets of tiles
• LazyScripter: from Empire to double RAT
• Leaving our ZIP undone: how to abuse ZIP to deliver malware apps
• Levelling up: why sharing threat intelligence makes you more competitive
• Lightweight emulation based IoC extraction for Gafgyt botnets
• Like bees to a honeypot – a journey through honeypots
• Linux/Moose endangered or extinct? An update on this atypical embedded Linux botnet
• Little Brother is watching - we know all your secrets!
• Look out! Outlook's gonna get you! Anurag Shandilya (K7 Computing)
• Looking into TUT's tomb the universe of threats in LATAM - Camilo Gutiérrez Amaya & Fernando Tavella
• Mac ing sense of the 3CX supply chain attack analysis of the macOS payloads - Patrick Wardle
• Magniber's missteps because even spiders trip over their own web Amata Anantaprayoon & Patrik Olson
• Making a dent in Russian mobile banking phishing
• Malicious Proxy auto-configs: An Easy Way to Harvest Banking Credentials
• May the Shadow Force be with Maggie – Shadow Force Group characteristics and relationship to Maggie
• Medical IoT for diabetes and cybercrime
• MEGALO 414E DON uncovering data espionage, blackmailing and shell companies in mobile lending
• Methods of malware persistence on Mac OS X
• Mobile Applications: a Backdoor into Internet of Things?
• Modelling the network behaviour of malware to block malicious patterns
• Modern Attacks on Russian Financial Institutions
• Modern reconnaissance phase on APT – protection layer
• Most sophisticated technique of the year goes to…
• NetWalking on Sunshine
• Never before had Stierlitz been so close to failure
• Neverquest: Crime as a Service and On the Hunt for the Big Bucks
• Nine circles of Cerber
• Notes on click fraud: American story
• Now you see it, now you don't: wipers in the wild
• Nymaim: the Untold Story
• Offensive malware analysis: dissecting OSX/FruitFly via a custom C&C server
• Office bugs on the rise
• On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users
• One year later: Challenges for young anti-malware products today
• One-Click Fileless Infection
• Oops! It happened again!
• Open Source Malware Lab
• Opening Keynote: Collaborating with Competitors: A Better Strategy to Beat Adversaries
• Operation Bookcodes – targeting South Korea
• Operation LagTime IT: colourful Panda footprint
• Operation Newton: Hi Kimsuky? Did an Apple(seed) really fall on Newton’s head?
• OPSEC for security researchers
• Optimized mal-ops. Hack the ad network like a boss
• P0wned by a barcode: stealing money from offline users
• PAC - the Problem Auto Config (or stealing bank accounts with a 1KB file)
• Panel discussion: Addressing the ransomware threat from outside the lab Chester Wisniewski et al.
• Panel: Flattening the Curve of Cyber-Risks
• Panel: Securing the future the vital role of computer security vendors in an AI-driven world
• Pay2Key – the newly discovered ransomware traced all the way to Iran
• Payment required: rare HTTP statuses and air-gaps avoidance from the authors of COMPFun
• Play fuzzing machine - hunting iOS and macOS kernel vulnerabilities automatically and smartly
• POS fraud - trends and counter-actions to mass fraud
• Possible supply chain attack targeting South Asian government delivers Shadowpad - Daniel Lunghi
• Presentation of the 1st Péter Szőr Award
• Protecting financial institutions from banking malware's man-in-the-browser attacks
• Pulling the PKPLUG: the adversary playbook for the long-standing espionage activity of...
• Quantifying maliciousness in Alexa top-ranked domains
• R2R stomping – are you ready to run - Jiří Vinopal (Check Point Research)
• Ramsay: A cyber-espionage toolkit tailored for air-gapped networks
• Ransoming and clipping for illicit cryptocurrency gains - Chetan Raghuprasad (Cisco Talos)
• Ransomware Evolution in LATAM
• Ransomware: a correlation between infection vectors and victims
• RedStinger new APT discovered amid Russia Ukraine conflict - Roberto Santos & Hossein Jazi
• Reverse Android malware like a Jedi Master
• Rich headers: leveraging the mysterious artifact of the PE format
• ROSCO: Repository Of Signed COde
• Sandworm: reading the indictment between the lines
• Security: the hidden cost of Android stalkerware
• Shades of Red: RedXOR Linux backdoor and its Chinese origins
• ShadowPad: the masterpiece of privately sold malware in Chinese espionage
• SharpTongue pwning your foreign policy, one interview request at a time - Tom Lancaster (Volexity)
• She sells root shells by the C(++) shore
• Shedding skin - Turla's fresh faces
• Shinigami's revenge: the long tail of Ryuk malware
• Side loading is not dead the Chinese and the Korean way - Gabor Szappanos (Sophos)
• Silent whispers of malware unveiling hidden threats in legitimate network traffic - Royce Lu
• Sizing cybercrime: incidents and accidents, hints and allegations
• Smart home appliance security & malware
• Solving the (in)security of home networked devices
• South Korean Android banking menace FakeCalls - Raman Ladutska (Check Point)
• Speaking Dyreza protocol. Advantages of 'learning' a new language
• Spoofing in the reeds with Rietspoof
• Standardized reporting with the Malware Behavior Catalog
• Static analysis methods for detection of Microsoft Office exploits
• Statistically effective protection against APT attacks
• Stealthy WastedLocker: eluding behavior blockers, but not only
• STK, A-OK? Stopping messaging attacks on vulnerable SIMs
• SubCrawl – a framework for the analysis and clustering of hacking tools found using open directories
• Surviving 0-days - reducing the window of exposure
• Sweeping the IP space: the hunt for evil on the Internet
• Swipe away, we're watching you
• TA505: attacking industries around the world
• Take care, spyware is slipping into your phones through Operation Poisoned News
• Tales from a cloud CSIRT – let's deep dive into a Kubernetes k8s infection - Santiago Abastante
• Targeted attacks through ISPs
• Teasing the secrets from threat actors malware configuration extractors - Mark Lim
• Tech Support Scams 2.0: an inside look into the evolution of the classic Microsoft tech support scam
• TetrisPhantom targeted attacks using secure USB - Noushin Shabab (Kaspersky)
• The (f)utility of indicators
• The baffling Berserk Bear: a decade’s activity targeting critical infrastructure
• The Bagsu banker case
• The Beginning of the End(point): Where we are now and where we'll be in five years
• The Big Bang Theory by APT-C-23
• The cake is a lie! Uncovering the secret world of malware-like cheats in video games
• The Dragon who sold his Camaro reversing a custom router implant - Itay Cohen (Check Point)
• The Dropping Elephant never dropped - Ye Jin (Kaspersky)
• The elephant in the room
• The ethics and perils of APT research: an unexpected transition into intelligence brokerage
• The evolution of webinjects
• The history & tactics of visa-centric scams in search, spam & social apps - Chris Boyd
• The Internet of Bad Things, Observed
• The keksec botnets we observed in the past year
• The Kobayashi Maru dilemma
• The life story of an IPT - Inept Persistent Threat actor
• The modality of mortality in domain names
• The NExt Big Sur(ge) on macOS
• The push for increased surveillance from fiction and its impact on privacy
• The rise of the info stealers
• The router of all evil: more than just default passwords and silly scripts
• The sprawling market of consumer spyware
• The state of cybersecurity in Africa: Kenya
• The TAO of .NET and PowerShell malware analysis
• The Unbearable Lightness of APTing
• The Volatility Bot-Excavator
• The wolf in sheep's clothing - undressed
• The ‘Ghost Hand’ attack
• Threat hunting: from SolarWinds to Hafnium APT
• Thwarting Emotet email conversation thread hijacking with clustering
• TIPS Keynote: Building secure sharing systems that treat humans as features not bugs
• TIPS Keynote: Nexus between OT and IT threat intelligence
• TIPS#1 Keynote: The Community Effect
• TIPS#10 Peak Analyzer: an automated malware campaign detector
• TIPS#11 New PlugX Fingerprint-THOR
• TIPS#12 Keynote: Learning from failure: ransomware and future conflicts
• TIPS#2 Now you see me, now you don’t
• TIPS#3 Operation Diànxùn: a cyberespionage campaign targeting telecommunication companies
• TIPS#4 Panel: A tale of two companies
• TIPS#6 The use of dark patterns and psychological tricks in Android malware
• TIPS#7 Incident response with an XDR
• TIPS#8 Where’s your data? Ransomware: protecting your ICS environment
• TIPS#9 Fireside chat: Good times, bad times, you know I’ve had my share [...]
• Tracking Rapid Evolution? Copycat? of An APT RAT in Asia
• Transparency, Trust and Intention: What dismantling the heart of cyberattack public attribution[...]
• Triada: the past, the present and the (hopefully not existing) future
• Turla and Sandworm come filelessly - Alexander Adamov (NioGuard Security Lab)
• TurlaSat: The Fault in our Stars
• Turning Trickbot: decoding an encrypted command-and-control channel
• Ubiquity, security and you - malware, security and the Internet of Things
• UNC788: Iran’s decade of credential harvesting and surveillance operations
• Uncovering automatic Obfuscation-as-a-Service for malicious Android applications
• Under the hood - the automotive challenge
• Unpacking the packed unpacker: reversing an Android anti-analysis library
• Unveiling the CryptoMimic
• Unveiling the kernel: rootkit discovery using selective automated kernel memory differencing
• USB flows in the Great River classic tradecraft is still alive - Hiroshi Takeuchi (MACNICA)
• VB2013 Keynote : Ethics and the AV industry in the age of WikiLeaks
• VB2017 paper: VirusTotal tips, tricks and myths
• W3LL phishing kit – the tools, the criminal ecosystem, and the market impact - Martijn van den Berk
• Walking in your enemy's shadow: when fourth-party collection becomes attribution hell
• Wave Your False Flags! Deception Tactics Muddying Attribution in Targeted Attacks
• WaveAtlas: surfing through the landscape of current malware packers
• We know it before you do: predicting malicious domains
• We know what you did this summer: Android banking trojan exposing its sins in the cloud
• We need to talk - opening a discussion about ethics in infosec
• Web3 will bite you in the Web 2 0 exploring IPFS threats - Morton Swimmer (Trend Micro)
• Webcam interception and protection in kernel mode in Windows
• Well, that escalated quickly. From penny-stealing malware to multi-million-dollar heists
• When a botnet cries detecting botnet infection chains - Guillaume Couchard & Erwan Chevalier
• When malware changed its mind: an empirical study of variable program behaviours in the real world
• Where have all the good hires gone?
• Where is the cuckoo egg?
• Who wasn’t responsible for Olympic Destroyer? (Paul Rascagnères & Warren Mercer)
• Wild Android Collusions
• Will Android trojan, worm or rootkit survive in SEAndroid and containerization?
• Your five most critical M365 vulnerabilities revealed and how to fix them (Partner Content)