Virus Bulletin Conference 2025 (VB2025)
Long-running threat intelligence and malware research conference featuring in-depth analysis of APT campaigns, ransomware, loaders, and the Threat Intelligence Practitioners' Summit.
→ See editor’s top picks at Virus Bulletin Conference 2025 (VB2025)
- Silent killers: unmasking a large-scale legacy driver exploitation campaign — Jiří Vinopal
In the ever-escalating arms race between cyber defenders and attackers, the exploitation of vulnerable kernel-mode drivers has emerged as a particularly potent weapon. Jiří Vinopal, a Threat…
- The attribution story of WhisperGate: an academic perspective — Alexander (Oleksandr) Adamov, Anders Carlsson
This talk, presented by Alexander Adamov and Anders Carlsson, delves into the complex and often controversial process of attributing sophisticated cyberattacks, using the WhisperGate campaign as a…
- The Wolf of Wall Steal: inside crypto traffer group operations — Anna Pham, Joan Garcia
In "The Wolf of Wall Steal: Inside Crypto Trafficker Group Operations," Anna Pham and Joan Garcia expose the sophisticated tactics and organizational structures of Russian-speaking cybercrime groups…
- Demystifying the Playboy RaaS — Gijs Rijnders
In this insightful presentation at Virus Bulletin, Gijs Rijnders, a Malware Reverse Engineer with the Dutch National Police, meticulously dissects the inner workings of an elusive…
- Evading in plain sight: how adversaries beat user-mode protection engines for over a decade — Omri Misgav
In this insightful talk, independent researcher Omri Misgav delves into the pervasive and often underestimated methods adversaries employ to bypass user-mode protection engines. Highlighting a…
- Collaborative response to emerging critical RCE vulnerabilities in exposed edge devices — Piotr Kijewski
In an era where critical Remote Code Execution (RCE) vulnerabilities in exposed edge devices are rapidly exploited by diverse threat actors, the need for a coordinated and agile response has never…
- Invisible thieves in the front yard - from an advanced evasive edge-device attack to potential mitigation methods — Ting-Wei Hsieh
In this compelling presentation at Virus Bulletin, Ting-Wei Hsieh, a Malware Analyst from CHT Security Co, unveiled the intricate details of a sophisticated espionage campaign that compromised a…
- Goodbye loaders, hello RMM: the rise of legit software in ecrime campaigns — Selena Larson, Ole Villadsen
In a significant shift observed since mid-2024, cybercrime campaigns are increasingly leveraging legitimate Remote Monitoring and Management (RMM) software as a first-stage payload, directly…
- Silent Lynx: uncovering a cyber espionage campaign in Central Asia — Subhajeet Singha, Sathwik Ram Prakki
In a revealing presentation at Virus Bulletin, Seqrite Labs researchers Sathwik Ram Prakki and Subhajeet Singha unveiled "Silent Lynx," a persistent and evolving cyber espionage campaign primarily…
- ClickFix: exploiting the clipboard for multi-stage payload delivery across OS platforms — Prashant Tilekar
In this compelling talk, Prashant Tilekar from Forescout Technologies unveiled "ClickFix," a sophisticated and rapidly evolving social engineering tactic that leverages the system clipboard for…
- European PDNS readiness — Viliam Peli, George Buhai
This talk, "European PDNS readiness," delivered by George Buhai and Viliam Peli of Whalebone, delves into the critical need for robust, EU-centric Protective DNS (PDNS) infrastructure across Europe…
- Chinese APTs targeting semiconductor companies in South Asian countries — Niranjan Jayanand, Deepak Nayak
This talk, presented by Niranjan Jayanand of CyberProof, delves into an ongoing investigation into sophisticated cyberattacks attributed to Chinese Advanced Persistent Threat (APT) groups targeting…
- The dark prescription: inside the infrastructure of illegal online pharmacies — Lubos Bever, Jan Rubín
The internet, a boundless source of information and commerce, has unfortunately become a fertile ground for illicit activities, prominently including the proliferation of illegal online pharmacies…
- Unmasking the GrassCall campaign: the hackers behind job recruitment cyber scams — Dixit Panchal, Soumen Burma
The "Unmasking the GrassCall campaign" presentation at Virus Bulletin delved into an advanced social engineering campaign primarily targeting the burgeoning web3 and cryptocurrency sectors…
- No payload for you: inside Sidewinder's selective exploitation strategy — Eliad Kimhy, Santiago Pontiroli
This talk, presented by Eliad Kimhy and Santiago Pontiroli from Acronis, delves into the evolving tactics of the Sidewinder advanced persistent threat (APT) group. Often characterized as less…
- Attacker identity revealed: insights from rogue VMs & BYOVD in EDR evasion — Navin Thomas, Renzon Cruz, Cuong Dinh
In a revealing presentation at Virus Bulletin, Renzen Cruz and Navin Thomas from Palo Alto Networks' Unit 42 unveiled a compelling case study where an incident response engagement inadvertently led…
- Cracked by the GRU: how Russia's notorious Sandworm unit weaponizes pirated software usage to target Ukraine — Arda Büyükkaya
In this compelling talk, Arda Büyükkaya, a Senior Threat Intelligence Analyst at EclecticIQ, unveiled how the notorious Russian state-sponsored threat actor Sandworm (also known as APT44, linked to…
- Hunting potential C2 commands in Android malware via Smali string comparison and control flow analysis — JunWei Song
In the dynamic landscape of Android malware, understanding the Command and Control (C2) infrastructure and its associated commands is paramount for effective threat intelligence and defense. This…
- Smashing smishing by quashing quishing — Andrew Brandt
In his Virus Bulletin talk, "Smashing smishing by quashing quishing," Andrew Brandt, Principal Researcher at Netcraft, sheds light on the escalating threat of quishing – a sophisticated form of…
- Exploiting compiler theory to automate the extraction of IOCs from JavaScript malware — Matthew Nunes
In this insightful talk from Virus Bulletin, Matthew Nunes, a Reverse Engineer at PwC, unveils a powerful methodology for automating the deobfuscation of JavaScript malware and the subsequent…
- Arachnid alert: Latrodectus loader crawls through defences — Albert Zsigovits
In this insightful talk at Virus Bulletin, Albert Zsigovits from VMRay presented a comprehensive analysis of Latrodectus, a rapidly evolving and sophisticated malware loader. First observed in…
- When avatars come alive: understanding hybrid threat actors — Itay Cohen, Omer Benjakob
In an increasingly complex threat landscape, the traditional distinctions between cyber warfare, disinformation campaigns, and kinetic (physical) attacks are rapidly dissolving. This pivotal talk…
- Inside Akira, ransomware's Rust experiment — Ben Herzog
In "Inside Akira, ransomware's Rust experiment," Ben Herzog, a Security Researcher at Check Point, delivers a compelling account of manually reverse engineering an optimized Rust-compiled variant of…
- Rogue hirer, rogue hiree: workplace cyber threats to individuals and businesses — Chris Boyd
In this compelling talk from Virus Bulletin, Chris Boyd, Lead Analyst at Rapid7, sheds light on the multifaceted and evolving landscape of cyber threats impacting both businesses and individuals…
- How MITRE is AI, anyway? — Samir Mody
In an era saturated with hype surrounding Artificial Intelligence, especially Generative AI (GenAI), Samir Mody from K7 Computing delivered a thought-provoking talk at Virus Bulletin, challenging…
- You definitely don't want to CopyPaste this: FakeCaptcha ecosystem — Dmitrij Lenz, Roberto Dasilva
In a compelling presentation at Virus Bulletin, Google security researchers Roberto Dasilva and Dmitrij Lenz unveiled the intricate and rapidly evolving ecosystem behind ClickFix, a malicious…
- Fireside chat: The tortured "cybersecurity" poets department — Jeannette Jarvis, Kathi Whitbey, Jeanette Miller, Selena Larson
This engaging panel discussion, titled "Fireside chat: The tortured 'cybersecurity' poets department," delved into critical challenges facing the cybersecurity industry, guided by the lyrical themes…
- The Phantom Circuit: the Lazarus Group's evolution in supply chain compromise — Ryan Sherstobitoff
In "The Phantom Circuit: the Lazarus Group's evolution in supply chain compromise," Ryan Sherstobitoff, CIO at SecurityScorecard, unveils a sophisticated and persistent campaign by the notorious…
- Stop the flood: building a quality and trust-driven threat intelligence ecosystem — Kihong Kim, SuhMahn Hur
In the rapidly evolving landscape of cyber threats, Threat Intelligence (TI) has become an indispensable component of defensive strategies. However, the sheer volume and often questionable quality…
- Inside Pandora's Box: dissecting the latest arsenal and tactics of APT27 — Naoki Takayama
In this insightful talk, Naoki Takayama, a security researcher at Internet Initiative Japan (IIJ), delves into the evolving toolkit and sophisticated tactics of APT27, a notorious China-nexus…
- Beyond machine translation: struggles and adaptations of North Korean IT workers in Japan's crowdsourcing market — Yoshihiro Kori, Takahiro Kakumaru
This presentation, delivered by Yoshihiro Kori and Takahiro Kakumaru from NEC, delves into the often-overlooked activities of North Korean IT workers operating within the Japanese crowdsourcing…
- Deep dive into the abuse of DL APIs to create malicious AI models and how to detect them — Mohamed Nabeel, Alex Starov
In an era increasingly dominated by artificial intelligence, the security of Deep Learning (DL) models has become a critical concern. This talk, delivered by Mohamed Nabeel and Alex Starov from Palo…
- Stealth over TLS: the emergence of ECH-based C&C in ECHidna malware — Yuta Sawabe, Rintaro Koike
In this insightful talk from Virus Bulletin, Yuta Sawabe, a security researcher at Entity Security Holdings, unveiled ECHidna, a novel piece of malware leveraging the cutting-edge Encrypted Client…
- Shared secret: EDR killers in the kill chain — Gabor Szappanos, Steeve Gaudreault
In this insightful presentation, Gabor Szappanos, representing joint work with Steeve Gaudreault, delves into the critical role of EDR killers within modern ransomware attack chains. Moving beyond…
- Measurement matters — Michael Daniel
In his compelling Virus Bulletin presentation, "Measurement matters," Michael Daniel, President and CEO of the Cyber Threat Alliance, tackles a profound and persistent challenge in cybersecurity…
- Tracking the IoT botnet's bloodline: code footprints don't lie — Chanbin Jeon, ChangGyun Kim, SeungBeom Lim
The proliferation of Internet of Things (IoT) devices has ushered in a new era of security challenges, making them prime targets for sophisticated botnets. This talk, presented by the SANDS Lab team…
- Prediction of future attack indicators based on the 2024 analysis of threats from malicious app distribution sites in South Korea — Kyung Rae Noh, Shinho Lee, Eui-Tak Kim, Yujin Shim, Jonghwa Han, Jung-Sik Cho
This talk, presented by Kyung Rae Noh (Anthony) from the Korea Internet Security Agency (KISA), delves into a sophisticated analysis of smishing attacks and malicious application distribution…
- Unmasking the unseen: a deep dive into modern Linux rootkits and their detection — Ruben Groenewoud, Remco Sprooten
In "Unmasking the unseen: a deep dive into modern Linux rootkits and their detection," Ruben Groenewoud and Remco Sprooten, both Security Research Engineers at Elastic, provide a comprehensive…
- Beyond the SERP: when black hat SEO campaigns evolve into a multi-faceted criminal threat — Joey Chen
In this insightful talk from Virus Bulletin, Cisco Talos security researcher Joey Chen unravels the alarming evolution of black hat SEO campaigns, demonstrating how they have transcended mere search…
- Sophistication or missed opportunity? Analysing XE Group's long-term exploitation of zero-days with limited impact — Justin Lentz, Nicole Fishbein
In this compelling talk from Virus Bulletin, Justin Lentz and Nicole Fishbein dissect the enigmatic activities of the XE Group, a persistent threat actor whose recent operations raise more questions…
- Boosting URL detection with syntactic features in spam emails — Antonia Scherz
In the ever-evolving landscape of email security, detecting malicious URLs remains a critical challenge. Antonia Scherz, a Data Scientist at Net at Work, presented a focused talk at Virus Bulletin…
- Don't fear journalists! Talk to me! — Omer Benjakob
In his compelling Virus Bulletin talk, "Don't fear journalists! Talk to me!", Omer Benjakob, an investigative journalist for Haaretz in Israel, challenges the conventional, often adversarial…
- From billion queries to action: how DNS4EU transforms threat defence — Sebastian Garcia, Tigran Oganesian
This talk, presented by Sebastian Garcia from the Stratosphere Laboratory at the Czech Technical University in Prague, delves into the monumental challenge of securing DNS4EU, the European Union's…
- Intercepting entropy: hooking PRNG to recover ransomware encryption keys — Raviv Rachmiel
In this compelling talk, Raviv Rachmiel, a seasoned reverse engineer and cybersecurity consultant, presents a novel approach to ransomware decryption by intercepting the Pseudo-Random Number…
- Unmasking TAG-124: dissecting a prevalent traffic distribution system in the cybercriminal ecosystem — Julian-Ferdinand Vögele
In this insightful presentation at Virus Bulletin, Julian-Ferdinand Vögele, a Threat Researcher at Recorded Future, peeled back the layers of TAG-124, a sophisticated and increasingly prevalent…
- The Bitter end: unravelling 8 years of APT antics — Abdallah Elshinbary, Nick Attfield, Konstantin Klinger, Jonas Wagner
This talk, a collaborative research effort between Proofpoint and Threatray, delves into the persistent and evolving tactics of TA397, also known as Bitter. For years, public research has broadly…
- Vietnamese hacking group: a rising of information-stealing campaigns going global — Chetan Raghuprasad, Joey Chen
This talk, presented by Chetan Raghuprasad of Cisco Talos, delves into the rapidly evolving landscape of Vietnamese cybercrime, highlighting a significant shift from localized operations to a global…
- Binary facades: script extraction from compiled macOS malware — Patrick Wardle
In this insightful talk, "Binary facades: script extraction from compiled macOS malware," renowned macOS security researcher Patrick Wardle of Objective-See and W delves into a common, yet often…
- Malicious GenAI Chrome extensions: unpacking data exfiltration and malicious behaviours — Shresta B. Seetharam, Mohamed Nabeel, William Melicher
This talk, presented by Shresta B. Seetharam from Palo Alto Networks, alongside co-authors Mohamed Nabeel and William Melicher, delves into the burgeoning threat landscape of malicious Generative AI…
- Emmenhtal Loader: the silent enabler of modern malware campaigns — Lovely Antonio, Ricardo Pineda, Louis Sorita
In this insightful talk, "Emmenhtal Loader: the silent enabler of modern malware campaigns," security researchers Louis Sorita, Ricardo Pineda, and Lovely Antonio from G Data AV Lab's Manila office…
- Closing keynote: Cybersecurity 2035: where will we be in 10 years' time? — Paul Ducklin
In his closing keynote at Virus Bulletin, veteran cybersecurity expert Paul Ducklin delivered a thought-provoking address titled "Cybersecurity 2035: where will we be in 10 years' time?" Far from…