Best Talks at Virus Bulletin Conference 2025 (VB2025)

Hand-picked from in-depth reviewer verdicts — the top 12 talks from this conference. Skip the noise, find the signal.

← All talks at Virus Bulletin Conference 2025 (VB2025)

1

Silent killers: unmasking a large-scale legacy driver exploitation campaign

Jiří Vinopal

In the ever-escalating arms race between cyber defenders and attackers, the exploitation of vulnerable kernel-mode drivers has emerged as a particularly potent weapon. Jiří Vinopal, a Threat Researcher at Check Point Research, illuminated this critical attack vector in his…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
2

The Wolf of Wall Steal: inside crypto traffer group operations

Anna Pham, Joan Garcia

In "The Wolf of Wall Steal: Inside Crypto Trafficker Group Operations," Anna Pham and Joan Garcia expose the sophisticated tactics and organizational structures of Russian-speaking cybercrime groups specializing in cryptocurrency theft. This compelling presentation unveils the…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
3

Evading in plain sight: how adversaries beat user-mode protection engines for over a decade

Omri Misgav

In this insightful talk, independent researcher Omri Misgav delves into the pervasive and often underestimated methods adversaries employ to bypass user-mode protection engines. Highlighting a decade of established techniques, Misgav meticulously breaks down the fundamental…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
4

Invisible thieves in the front yard - from an advanced evasive edge-device attack to potential mitigation methods

Ting-Wei Hsieh

In this compelling presentation at Virus Bulletin, Ting-Wei Hsieh, a Malware Analyst from CHT Security Co, unveiled the intricate details of a sophisticated espionage campaign that compromised a cloud service provider in Taiwan. The talk, titled "Invisible thieves in the front…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
5

Goodbye loaders, hello RMM: the rise of legit software in ecrime campaigns

Selena Larson, Ole Villadsen

In a significant shift observed since mid-2024, cybercrime campaigns are increasingly leveraging legitimate **Remote Monitoring and Management (RMM)** software as a first-stage payload, directly delivered via email. This talk by Proofpoint researchers Selena Larson and Ole…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
6

When avatars come alive: understanding hybrid threat actors

Itay Cohen, Omer Benjakob

In an increasingly complex threat landscape, the traditional distinctions between cyber warfare, disinformation campaigns, and kinetic (physical) attacks are rapidly dissolving. This pivotal talk, "When avatars come alive: understanding hybrid threat actors," presented by Itay…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
7

You definitely don't want to CopyPaste this: FakeCaptcha ecosystem

Dmitrij Lenz, Roberto Dasilva

In a compelling presentation at Virus Bulletin, Google security researchers Roberto Dasilva and Dmitrij Lenz unveiled the intricate and rapidly evolving ecosystem behind **ClickFix**, a malicious technique widely known as **FakeCaptcha**. This talk delves into a sophisticated…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
8

Beyond machine translation: struggles and adaptations of North Korean IT workers in Japan's crowdsourcing market

Yoshihiro Kori, Takahiro Kakumaru

This presentation, delivered by Yoshihiro Kori and Takahiro Kakumaru from NEC, delves into the often-overlooked activities of North Korean IT workers operating within the Japanese crowdsourcing market. While much of the existing research on North Korean cyber activities focuses…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
9

Deep dive into the abuse of DL APIs to create malicious AI models and how to detect them

Mohamed Nabeel, Alex Starov

In an era increasingly dominated by artificial intelligence, the security of **Deep Learning (DL)** models has become a critical concern. This talk, delivered by Mohamed Nabeel and Alex Starov from Palo Alto Networks, delves into a novel and insidious method of injecting…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
10

Stealth over TLS: the emergence of ECH-based C&C in ECHidna malware

Yuta Sawabe, Rintaro Koike

In this insightful talk from Virus Bulletin, Yuta Sawabe, a security researcher at Entity Security Holdings, unveiled **ECHidna**, a novel piece of malware leveraging the cutting-edge Encrypted Client Hello (ECH) TLS extension for its command-and-control (C2) communications…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
11

Shared secret: EDR killers in the kill chain

Gabor Szappanos, Steeve Gaudreault

In this insightful presentation, Gabor Szappanos, representing joint work with Steeve Gaudreault, delves into the critical role of **EDR killers** within modern ransomware attack chains. Moving beyond the traditional "AV killers" moniker, Szappanos highlights how threat actors…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆
12

Unmasking the unseen: a deep dive into modern Linux rootkits and their detection

Ruben Groenewoud, Remco Sprooten

In "Unmasking the unseen: a deep dive into modern Linux rootkits and their detection," Ruben Groenewoud and Remco Sprooten, both Security Research Engineers at Elastic, provide a comprehensive exploration of the evolving landscape of Linux rootkits. This talk delves into the…

0 Dr. Zero STRONG ACCEPT ★★★★☆ H Heather Calloway STRONG ACCEPT ★★★★☆