Note that live stream times are different from the program schedule

Tune in to PHDays from anywhere in the world

We use cookies. By staying on this website, you agree to our <privacyCookiesPolicy>cookie usage policy.</privacyCookiesPolicy>

Buy tickets

Talk not found

You can view the program as a list for a better experience on mobile devices

Try changing filters or clear the "Hide finished talks" check box.

No results

That's it. You can check out the schedule for other days

For more information, go to the PHDays Fest website: {url}

Make sure the link is correct or have a look at who else will be speaking at the cyberfestival.

Speaker not found

Try changing filters or your search query.

Explaining hot topics of cybersecurity and IT in plain language and sharing lifehacks you can use at home

Понятным языком разбираем актуальные темы и лайфхаки кибербеза и IT, которые пригодятся в повседневной жизни  

Научпоп

PopSci

For everyone

Popular presenter and blogger Cyril Didenok talks to IT. 

Honest interviews on technology with cybersecurity and IT experts

Popular presenter and blogger Cyril Didenok talks to IT.

How girls can succeed in IT and cybersecurity

Scooters or flying saucers—what will transportation be like in the future?

Cyberbullying

Burn IT out: why IT professionals burn out so fast

Online piracy: is there a solution?

Learn all about the mistakes users typically make when using online services, and the the most important measures for protecting you personal data. 
We will analyze the state of personal data leaks in Russia and worldwide (what kind of data is most often disclosed and what companies are doing to protect their customers' data). What do I need to do to protect my personal data?

How to protect your personal data without becoming paranoid

Why are chips so small and how are they made? What is a "wafer" and a "nanometer," plus a bunch of other interesting facts from the world of microelectronics.

What it costs to build a chip: what are modern microelectronics and nanometers, and why do we need them?

From virtual museum tours to biometric access systems, here is how modern technology is helping preserve art. The talk will cover historic heists at the world’s most famous museums and the consequences, including the public reaction and the steps taken by the museums.

We will focus on the latest methods and tools in analysis and protection. The talk will reveal how to find secret doors in any museum, how to view masterpieces in any country in the world without leaving your room, and what can often be discovered underneath famous paintings.

What need would a hacker have for the Mona Lisa?

We will discuss phishing techniques, including those using email, social media, spoofed websites . We will review a few real-life examples of psychological techniques that cybercriminals use. You will get tips on how to recognize attacks and protect yourself and your data.

Phishing: the art of deception in the digital world

Reverse engineering as a profession: why we need it

In the news, you often hear about the use of deepfakes and voice cloning for malicious purposes, including phone scams, creating obscene content, and the unpaid use of the voices of actors But there is a positive side: creating your own datasets from your voice data and photos for use in movies and ads, or bloggers using automated payments and licensing through smart contracts on the blockchain.

Deepfakes as a new way to engage with an audience and monetize content

The bottleneck problem: why the idea of resurrecting your career by entering IT is no longer viable

AI-generated animation is opening new horizons in the marketing and creative industries, enabling the creation of impressive video content with minimal time and resources. This talk is about using AI for video creation and its application in advertising campaigns and media projects.

How to use AI-generated videos in marketing and other creative industries?

Stand-up comedy on how tricky life can be in the digital age

Ditch the romantic stereotypes: why cybersecurity is not just about hackers

We all know to never give our PIN to scammers, to use complex passwords, and so on. However, few of us know how banks protect their customers’ money.

This talk covers major attacks on banks, how banks defend against them, and where the bank’s problems end and the customer’s problems begin.

"It’s not your problem." How banks protect your money

- For whom cyberranges are intended and why. 
- How they are set up. 
- What processes are involved. 
- How they affect our security. 
- Who ethical hackers are, what they do, and whether anyone can become one.

What is a cyberrange, or where do hackers train?

The invisible ransomware virus epidemic

The speaker will describe how programming assistants are set up today and why you might be—but shouldn’t be—afraid of AI in programming.

Will AI replace programmers

How joint development, open source, and professional communities have revolutionized digitalization

Your devices are monitoring your every move. Your home appliances are spying on you 24/7. Social media corporations know more about you than your friends and parents do. All the information the collect is fed into big-data databases, forming an exhaustive digital dossier.

Then, certain gifted people, the trailblazers in the digital forest, mine this information with ease using OSINT techniques. How? That’s what the talk will be about.

It’s not your imagination: they are watching you. How to find out everything about a person using OSINT

We will discuss the basic categories and typologies of fraud schemes. What awaits the individual in the digital sphere. We will discuss the relevant figures (from the regulator, agencies, and our platform, experts), what the trends are and why, what is being done in relation to these figures and the correlation between the actions and figures. We will discuss the figures on the topic (from the regulator, agencies, our platform, experts), what are the trends and why, what is being done in relation to these figures and what is the correlation between actions and figures.

Bloggers and online scammers: how to follow them without falling for the bait. Phishing sites, remote access programs, and viruses: where you can run into them and how to recognize and avoid them. The rules of digital hygiene, security settings in messengers and social networks, and adopting a conscientious attitude to your personal data when active in the digital sphere.

Don’t get caught: a blacklist of the top 10 fraud schemes in the digital space

We will discuss the first publication to outline the issues faced in the digital world in a manner that anyone can understand. All about the relevance of the project, its objectives, approach and, of course, content.

Positive Hack Media as a guide to the digitalization of everything

Most common scams on social media

Phygital world and its mindset transformation tools

Artificial intelligence in film production

One in seven successful attacks in 2023 targeted ordinary people. Attacks often use the current news agenda as it increases the trust of victims and the likelihood of successful deception. What schemes do attackers use? At what time of year are they particularly active and what events trigger them? If there are so many attacks, how can the average user protect themselves from them?

"Bank security" scammers, Black Friday, and deepfakes: how we’re tricked in our daily life

Positive Hack Days festival. Opening

DJ Adisson. Cybercity. Live stream: Standoff 13. Cyberarena. Hackfest

Assembly Model. Literary and music performance

Daily wrap-up

DJ Adisson

Lectures on technology and life in the digital world

Bringing space closer: a poetry concert

“Moth. Light. Flame. Dust.” Movie show

Moth. Light. Flame. Dust. Film screening

End-of-school festivities

Closing

- Race in IS: How white-hat hackers find loopholes minutes before a real hack and what an IS professional does to prevent incidents from happening 
- What defenses are reasonable and when paranoia kicks in 
- Running to stay in place: how to stay one step ahead of attackers

Security: what’s the purpose?

- Opening up cyber: why the cyber industry has long been considered a closed field and how the situation has changed today
- How to get into IS: what soft and hard skills to pump up and where to do it
- Internship in IS: step-by-step instructions

Accessible cybersecurity: how to land an internship

Cyberquest for kids. Awards ceremony

DJ Adisson. Cybercity. Live stream

Cybercity. Live stream

Youth day opening

Signing an agreement between Positive Technologies and ITMO University

- The AppSec Rise: Why Secure Development Specialists are in high demand right now.
- What the field of application security entails and what are the roles and areas of focus for an AppSec specialist?
- How to find your place in the industry and whether background is so important.

Guess what, I did it voluntarily! or how I got into secure development

- Who is a white hacker and what path of professional development he/she follows 
- What is meant by the hacker mindset
- What are the features and benefits of the profession 
- How to become part of the hacker community

The path of an ethical hacker: hack it if you can

All-Russian cyberbattle for university students. Awards ceremony

Standoff 13. Live

- Security operations center and blue team from the inside: how the work of a SOC analyst really works. 
- Dispelling myths: from routine and interesting tasks “floating away” to total overwork and ceiling in development.
- Bonus: career track of a SOC-analyst with specific requirements for each stage of growth of a specialist.

Working in a SOC: myths and reality

- How to get out of university quickly and build a career in IS. 
- About the path to IS: researching attacks on web and business applications, ATM, social engineering, CPO platform Standoff 365.

From development on a push-button phone to CPO in cybersecurity

- Who OSINT (open source intelligence) specialists are and what their job is.
- What techniques information hunters use to access your files and digital footprints.
- How to protect your personal data and preserve your privacy in today's “transparent warfare” environment.

Hunters in the digital forest: who’s hunting for your data and who’s guarding itHunters in the digital forest: who’s hunting for your data and who’s guarding it

- How the career of today’s young professionals differs from previous generations
- What managers and HR-managers expect from zoomers, why they love them and why they are afraid of them
- Cheat sheet for zoomers: how to prepare for an interview and establish yourself in the eyes of senior colleagues

Zoomer’s career: a helicopter view

- A career in IS without limits: how to set the right goals, assess your strengths and what to focus on.
- How to distinguish burnout from laziness and when it is better to take a break.
- The Power of a Mentor: How an experienced mentor can help you achieve intermediate career goals.

From burnout to inspiration: how not to give up in the long run

- Expectations vs. reality: whether the CISO role is suitable for everyone and what responsibilities it includes.
- Information security processes from the position of a director: what tasks a CISO solves himself and how to find a balance between management and technical expertise.
- Stages of professional development: how to grow to become a CISO.

Who are you, Mr. CISO?

- The Age of Artificial Intelligence: New Opportunities vs. New Challenges for IT
- Cyber threat trends: what technological challenges are facing IS researchers? 
- IS specialist skills map: what to develop today to protect against tomorrow’s threats

Threat exploration to spark innovation

DJ Adisson

Popular science. Lectures on technology and life in the digital world

Cybersecurity ambassadors. Positive Education Awards

The Podari Zhizn charity foundation

Positive Hack Days festival. About dreams, gratitude, and the future

Cyberfestival wrap-up

- Why it only takes five minutes to hack Google
- What skills an IS professional will need in the AI world of the future

How to hack a neural network in five minutes

Lectures on technology and life in the digital world.

New trends in deception

Standoff 13. Live stream

Children's CyberQuest. Rewarding

Talks by security assessment professionals and vulnerability researchers

Пул докладов от настоящих профи в тестировании защищенности систем и выявлении уязвимостей

Offense

Cybersecurity

The development infrastructure in large companies consists of a large number of components and an even larger number of integrations between these. These integrations can contain a variety of security issues. 

This talk will address serious security issues encountered by the speaker at various companies during security audits.


CI/CD unchained: searching for the weakest link in the development infrastructure

Creating a robust bug bounty program is all about the processes. We take a retrospective look at the experience gained at HackerOne and compare it with the current market situation.

Bug bounty: a view from the other side

This talk will discuss how old unresolved implementation issues and the stigma of legacy communication channel have contributed to the vulnerability of today's email to code injection. We will examine the features of email and the main mail protocols, consider the ways code can be injected into mail functionality, and review high-profile news stories about the possibility of impersonation found in major mail services.

You’ve got a mail: classic email attacks reimagined

More and more often information about in-memory code executions, shellcode injections, and BYOI methods appears on the net. It may seem that almost all problems with antiviruses can be solved if we find a way to put our payload into memory. Indeed, this used to be a great panacea, but times are changing. Modern antiviruses have learned to identify and detect previously unknown threats by analyzing memory regions.

In my talk, I will show you how to deal with memory regions! I will show you how important it is to consider and identify the right place for our pyload, as well as how to prevent multiple detections by antivirus and stay hidden from the eyes of defenses. We will explore various injection methods, using both the popular Mapping Injection, Function Stomping, Transacted Hollowing, and more sophisticated variants based on abusing the factory way of instantiating COM objects. Among other things, we will investigate artifacts arising in regions and find an answer to the question: where do we put shellcode when injecting?

Memory regions, or how I loaded the shellcode in the wrong place

The methods of exploitation for incorrect ACL configurations in Active Directory on User, Computer, and Group objects are known, but what if we have WriteProperty on the domain object itself? We explore which attributes may be of interest to an attacker and how this could lead to complete compromise of the domain infrastructure. In conclusion, we will discuss how to detect such types of attacks and defend against them.

New tricks of ACL abusers (Active Directory)

In this presentation, the speaker will discuss variations of payloads that were not covered in his PHDays 12 talk but are just as popular and relevant as effective initial access vectors. This material may seem more trivial or obvious compared to the previous one, as more well-known vectors will be discussed. However, in the speaker's opinion, it is important to supplement the previous material with a discussion of methods such as PDF or SVG smuggling, polyglot PDFs, and PDF luring, which are part of the widely used arsenal of payloads and vectors for gaining initial access.

Who’s knocking on your email: social engineering 2024

One day, a Mitsubishi FX series PLC landed on our desk. It had one flaw: it was impossible to obtain the firmware. Despite this, we were able to reverse-engineer the undocumented protocol and find 15 CVEs. So when we encountered Mitsubishi L and Q series PLCs with the same flaw, we were prepared.

In this presentation, we will share our experience: how knowledge of the protocol and vulnerabilities in one series helped find RCE in others, how the protocol can change in different series, how engineering software can assist exploitation, and how we managed to extract the firmware through a vulnerability. We will discuss the reverse engineering of the firmware and its structure: how it boots and what parts it consists of. We will cover various post-exploitation options and, of course, give a demo.



From DoS to RCE: digging into various Mitsubishi PLC series

This presentation will cover the following topics: creating an architecture and administering the infrastructure for conducting red-team pentests following best zero trust practices; using automation tools for malware development; deployment of an attack infrastructure in line with best DevOps practices. We will discuss methods of ensuring maximum secrecy of communication with attackers' C2 servers to counter network-level and endpoint-level detection. We will explore the tools that help structure the data obtained during testing and automate analytics of these data with the goal of enriching them and using them for further attacks. Based on the results of such testing, it is possible to assess the ability to resist advanced adversaries and formulate appropriate recommendations.

Trust no one: red-teaming infrastructure on steroids

Our research team conducted a security assessment on a popular AI-powered educational robot for kids leading us to the development of a chain of attacks that allowed us to compromise its security and stealthily gain unauthorized remote access to it.
In this presentation, we’re going through the process of how we approached and analyzed the robot’s internals along with its surrounding ecosystem. Then we will delve into the identified issues, to show how exploiting them could help to bypass many security mechanisms, such as making arbitrary video and voice calls to any robot.

Additionally, we will discuss the implications of these security flaws, particularly in relation to the leakage of personal sensitive data that we’ve discovered during our research.

Smart toy vulnerabilities can put your child at risk of abuse by strangers

It has been 24 years since the discovery of a null session. Nowadays, almost all system administrators can monitor and prevent a null session by enforcing strict security policies. Today, a quarter-century later, is it possible to revive a null session and bypass these restrictions and policies?

This talk invites you to explore the realm of MSRPC by developing a robust security research methodology and discover a new, unique method to enumerate domain users without triggering any alerts—a technique that defenders cannot easily stop. This presentation is designed for security researchers and penetration testers eager to deepen their understanding of MSRPC interfaces and enhance their research techniques.

Make a null session great again

What could be exciting about network scanning when the twenty-first century is entering its second quarter? Clone a Git repository, make a Go build, and then just feed the EtherChannel and PF_RING output into it. It’s not all that straightforward. Even a rough scan can be fun if you add some intelligence to it. Even if it’s artificial. 

In this talk, we’ll discuss:
- Using reinforcement learning for 64K traffic control.
- The search for «golden samples» of user datagrams.
- Fuzzy hashing and clustering (so GET doesn’t seem so endless).
- Conversations with ChatGPT about regexes.
- The hidden Internet, home to the site of the Ministry of Agriculture of North Elbonia.
- Blondes, brunettes, redheads, and how to avoid getting lost in honey traps.

We’ll also talk about other uses of ML and big data analytics when scanning the entire Internet.

Some bruteforce intelligence

We will focus on management and control: things that set hackers' hearts aflame. We'll go digging around in various boxes—big and small, black and various shades of gray—that inhabit your networks. We'll discuss important aspects of cybersecurity covering a rich range of diversity components in information systems: from home devices to corporate network devices.

Little big boxes

Every information security specialist has at least once heard about sandboxes—essential cybersecurity tools used to run suspicious programs in isolated environments. Yet, attackers continually develop methods to evade these systems.

This report will reveal the latest sandbox evasion techniques, including those based on forensic artifacts and virtual machine logs. It will also introduce a new graphical classification of evasion tactics and discuss well-known evasion techniques.

Waging war with the sandbox: techniques from the other side of the barricade

Biometric readers enhance security and convenience by identifying individuals through unique biological features. However, they are also prone to specific security vulnerabilities. This report will discuss the risks associated with biometric readers and how they can be mitigated.

It will also cover the advantages of using biometric readers in access control systems, and the results of a security assessment conducted on a major international company’s biometric reader. The findings will be particularly beneficial for researchers and security system architects.

Face/Off: show your quote

A study on secure boot and encrypted boot technology on Orange Pi 5 (Rockchip RK3588S).

Rock eBOOT, or how to encrypt an orange

Talks by experts in incident investigation and cybersecurity of systems, companies, and entire countries

Максимальная концентрация экспертов по расследованию инцидентов и защите систем, компаний и целых государств

Defense

This talk focuses on the discovery of an RCE vulnerability in the ClickHouse DBMS with such tools as AppArmor and Osquery. The speaker will explain how to detect further vulnerability exploitation.

A RCE vulnerability in Managed ClickHouse through the eyes of a SOC specialist at Yandex Cloud

DFIR specialists not only have to reconstruct information security incidents, but also have to work with images of attackers’ servers. The proposed report will present a methodology for analyzing them, as well as prepare scripts for converting logs and databases of popular post-exploitation frameworks (Cobalt Strike, Sliver and others) into a convenient form for further analysis.

What’s yours is now ours: the useful stuff you can find on hackers’ servers

The speaker will talk about trusted relationship attacks. You will learn how these attacks are carried out, what tactics, techniques, and procedures (TTP) attackers use, and how to defend against these.

Trust is good, too much trust is dangerous, or Trusted relationship attacks

New ads for malware, database samples, and access to corporate networks appear on shadow sites every day. These offers are often highly sought after by hackers targeting Russian companies. In addition to ensuring the quality of the content on offer, sellers need to maintain their reputation and compete for buyers with others who post a large number of similar ads.

This study focuses on analyzing how sellers promote their services on shadow sites, using as an example the characteristics of real products on offer, distribution channels, and pricing methods adopted for different items, such as malware and databases. Additionally, the speaker will explain how sellers position themselves on shadow sites, the specifics of post-sales service, and other aspects related to marketing, promotion, and customer service.

Dark promotion: a deep dive into pricing, distribution models, and promotion methods on shadow markets

We constantly hear about the most popular methods used by malicious actors: the top 10 techniques, the top 10 tools, the top 10 LOLBAS... Such popularity implies a high degree of detectability. However, malicious actors do not always use popular methods and tools. In this presentation, we will look at some atypical techniques and tools that the BI.ZONE Threat Intelligence team has observed in attacks on Russian organizations.

Beyond the norm: unusual methods and tools used in cyberattacks on Russian organizations

The past year, 2023, was the most productive for attackers in terms of the number of attacks on Russian companies. It is unlikely that this trend will reverse anytime soon—a decline in the number of breaches in nowhere in sight.

On the contrary, the situation is becoming more alarming. In our investigations, we encounter numerous hacker groups and, retrospectively evaluating incidents, often realize that the attackers could have been detected during the attack’s development, before it had an impact.

This talk will present practical experience in incident investigation. It will address the mistakes attackers make, what leads to successful compromises, how attackers can be detected in advance, and how just a little effort can go a long way in complicating the lives of cybercriminals and avoiding typical mistakes of IT and security departments.

And that’s why it all happened

In recent years, the popularity and need for remote work has increased drastically.
This led to an increase in the use of VPNs in organizations: a significantly larger number of employees are able to access a company's network from anywhere in the world.

Even if there is a properly segmented network, with granular issuance of the minimum necessary accesses, a VPN still gives access to a company's network.

In my report, I will tell you how to avoid unnecessary risk when granting VPN access to the least trusted groups of employees: external, outsourced, outstaff employees, and all sorts of contractors.
I will also explain how you can replace access to your company's network via VPN with the most point and granular access to web applications using a fairly simple and concise solution—Identity Aware Proxy.

Identity-Aware Proxy: taking a major leap towards zero trust

This talk will explore the built-in security tools of the Astra Linux operating system that can help with investigating incidents. Furthermore, the speaker will demonstrate detected operating system vulnerabilities that could help attackers bypass these security tools and elevate their privileges. The vulnerabilities have been patched. This topic has never been presented within the community before.

Incident response in information systems running on Astra Linux

Based on the results of the first stage of the Standoff cyber battle, the top 4 teams of attackers will make it to the playoffs, where they will compete for the main prize of the cyber battle — 7.5 million rubles. The attackers will have to fulfill a special task of Positive Technologies — to realize one of two unacceptable events in the digital twin of the target information systems of Positive Technologies.

Did the hackers succeed in achieving their goal and taking the desired reward? What awaited them along the way? We will reveal all the details at 17:30.

Standoff 13 cyber battle playoff recap

In 2023, data theft and encryption posed significant challenges. Companies facing these issues for the first time often mishandled their response strategies.

Common errors included erasing data from PCs under the mistaken belief of a virus, blocking update servers upon detecting suspicious network activities, and overestimating the role of insiders in data breaches. Even third-party specialists sometimes concluded investigations with "Unable to determine" or "No data available." 

This report will outline effective and ineffective practices in incident response.

Incident response blunders in 2023–2024

Imagine discovering a zero-click attack that targets your coworkers’ iOS devices, and then successfully analyzing every stage of this complex attack. Well, that’s exactly what happened to us! This led to the elimination of four zero-day vulnerabilities and the discovery of previously unknown and highly sophisticated spyware that had remained undetected for years. We call this attack «Operation Triangulation». This is the story of the most complex attack chain and spyware ever discovered by Kaspersky.

Operation Triangulation: why one shouldn’t attack researchers

This report analyzes the activities of the cyberespionage group Cloud Atlas throughout 2023 and 2024. It will cover the timeline of attacks, potential targets, tools used, network infrastructure, and the tactics, techniques, and procedures (TTPs) utilized by Cloud Atlas.

Additionally, the presentation will cover the latest attack chains of Cloud Atlas identified in Q4 2023 and offer recommendations for defending against these threats.

Navigating the fog of cyberwar: a review of APT Cloud Atlas attacks in 2023–2024

The geopolitical tensions in 2022 significantly influenced the activities of major APT groups. One of the key groups, known to the Solar’s 4RAYS team as Shedding Zmiy, ramped up its attacks against government organizations and their contractors handling sensitive data. The group also shifted its focus from financial gain to espionage. 

We’ve tracked dozens of attacks by the group; in seven of them, we were directly involved in investigation. We have noted a diverse arsenal and tactics employed by the group, including the use of previously unknown custom loaders, backdoors, and web shells; the use of compromised servers in the group’s infrastructure; and exploitation of uncommon vulnerabilities in ASP.NET. All this makes attack attribution extremely difficult. However, through meticulous effort, we’ve been able to find key evidence and prepared a summary of all the group’s operations we’ve investigated. 

This report will cover Shedding Zmiy’s attacks, highlighting the most interesting details and pointing out the traces left by the group. It will also provide insights on detecting and countering the attacks by the group.

Untangling the snake's nest: tracing the attacks by Shedding Zmiy

The goal of this presentation is to construct a psychological profile of adversaries to gain valuable insight into the motivations and driving forces behind cybercriminal behavior, dive into the realm of cybercriminal psychology by analyzing off-topic discussions among participants in dark web forums.

Inside the Dark Web: Exploring the Psychological Profiles of Cybercriminals

The Decoy Dog malware was publicly disclosed in April 2023, but it had been actively used by threat actors since at least 2021. Additionally, there is evidence that cybercriminals had been developing tools since as early as 2019. This stealthy and complex malware is an evolution of open-source Pupy RAT. The main capabilities of Decoy Dog include DNS tunnelling, DGA, personalization of execution (the malware is targeted at and executed only on the specific victim machine), execution telemetry, and etc.

In November 2023, we published a comprehensive report about new APT group Hellhounds. Currently, the Hellhounds APT group, which uses the Decoy Dog malware, is actively targeting organizations in Russia. According to our data, at least 48 organizations in the IT, government, space, energy, and other industries in Russia were compromised using Decoy Dog. Currently, the motivation behind the threat actors’ attacks remains unclear, but on one instance the attackers targeted a telecom operator in Russia and managed to put some of its services out of operation.

In our presentation, we are going to talk about:
1.  The evolution of Hellhound’s malware — from Pupy RAT to Decoy Dog;
2.  Versions of Decoy Dog for Linux and Windows (Decoy Dog for Windows has never been disclosed before);
3.  TTPs of Hellhounds, which we discovered during our incident investigations and research.

Hellhounds: operation Lahat

The project aims to enhance cybersecurity defenses by creating a system that collects, categorizes, and shares data on cyberthreats. Utilizing honeypots—decoy systems designed to attract attackers—the platform tracks and analyzes interactions to provide a comprehensive view of current cyberthreats. This collaborative effort involves multiple organizations, including government, community, and academic institutions, to gather and disseminate relevant threat intelligence. The project’s implementation began in Indonesia and is expanding to ASEAN and Asia Pacific regions, promoting a collective approach to cyberdefense.

The platform’s architecture allows for the integration of various honeypot types, offering a public dashboard for real-time threat monitoring. With the continuous rise of cyberthreats, this initiative serves as a crucial tool for organizations to proactively share and respond to potential security incidents. The ultimate goal is to establish a stable, intelligent threat sharing network that supports a wide range of organizations across different sectors and regions. This presentation will detail the platform’s development, challenges faced, and the impact on enhancing regional cybersecurity collaboration.

Development of Honeynet Threat Sharing Platform

I took a deep dive into the mistakes made by some of the world’s most prominent APTs. OPSEC (Operational Security) mistakes refer to errors or oversights that compromise the security and confidentiality of sensitive information.

These mistakes can include sharing passwords, using unsecured communication channels, discussing sensitive information in public spaces, or failing to properly secure devices and networks.

Hunting APTs with OPSEC mistakes

During our presentation, we will expose the operations of the TWELVE group, known for its relentless assaults on Russian Government organizations. While numerous researchers have documented the activities of this group, a comprehensive understanding of their tactics, techniques, and procedures (TTPs) has remained elusive. Our aim is to rectify this gap by shedding light on the actual TTPs employed by TWELVE.

Furthermore, we will discuss strategies for fortifying defenses against such attacks and unveil precise detection methods essential for thwarting threats of this nature. Join us as we unveil the intricate workings of TWELVE and equip ourselves with the knowledge to combat their onslaughts effectively.

The -=Twelve=- Chairs

The motto of many hackers, "No system is safe," prompts a crucial question in every organization: "Are we hacked, or not yet?" This question can be answered by performing a compromise assessment. 

In this report, we will discuss how and why we searched for evidence of hacker activity in our own infrastructure, and what we learned from it.

How we looked for evidence of compromise on our network

Talks on AI in cybersecurity, advances in machine learning, and how soon we all will be replaced by robots

Применение ИИ в кибербезе, машинное обучение и когда уже нас всех заменят роботы — обсуждаем в рамках этого трека 

AI Track

In everyday life, we are bombarded by a multitude of legends, Internet rumors, and myths. And one of the most intriguing areas concerning our security and technology is biometrics. Sometimes myths touch upon important technical details, posing absurd claims that are nevertheless impossible to debunk. Nevertheless, they can give people the wrong idea about the technology. During the presentation, the speaker will examine several popular claims about attacks on biometric systems and conduct an experiment to test how realistic they are.

Mythbusters: three experiments in biometrics

One of the promising areas in information security is the use of large language models (LLM). A LLM is a generative model which is trained on huge amounts of textual data and has over a billion weights. LLMs can analyze texts and draw conclusions from them. The speakers will talk about how their research helped them use these technologies to improve security and threat detection. The goal of the presentation is to demonstrate that large language models can be an effective tool for handling security tasks.

Using LLM in information security: on the way to an AI assistant

An anti-fraud system based on the latest GNN (graph neural network) and LLM models will be discussed. It is designed to identify bank clients susceptible to phone fraud.

MTS: your shield from phone scammers

Learn how a solution that optimizes the work of analysts and reduces alert fatigue was developed and implemented, and what challenges and pitfalls were encountered during the implementation.

Easing the load on a SOC analyst

Product search is not only a system for ranking products based on their textual relevance to customer queries but also a system for distributing traffic and determining a quality product offering. Search results are influenced by customers, sellers, and the organization’s business processes. The speaker will discuss measures a company can take to prevent employees from manipulating search results outside of business processes, and will also examine scenarios of internal search fraud, principles of protection building, and protection mechanisms.