COUNTERMEASURE26 Talk

Nation-state actors exploit trusted telecom, managed service, and IT providers to reach downstream networks and cloud tenants. This session examines how they compromise these providers and leverage that access for espionage.

Google GTIG investigates a PRC-linked espionage actor that used custom malware to target medical and scientific software, evade authentication and endpoint defenses, and steal data through covert cloud-based email routing. The presentation covers the campaign, disruption efforts, and defenses.

Op Night Owl: Part Deux

This talk is the story of hunting for a zero day Windows Local Privilege Escalation (LPE) destined for a hacking competition, successfully weaponizing it, and then watching the payout evaporate entirely due to unlucky timing and an inconvenient patch.

Experts in AI-enabled cyber offense and defense examine real shifts in exploit development and malware, separate credible risks from hype, and explore how organizations can govern and control increasingly capable AI agents.

Military AI can aid high-stakes decisions, but visible reasoning may not reflect how newer models reach conclusions. This talk examines the resulting trust gap and explores alternatives to chain-of-thought for meaningful human oversight.

This talk traces an unusual surveillance operation tied to a real-world event, combining infrastructure analysis, OSINT, and on-the-ground context to reveal a novel commercial-spyware infection vector and explore its implications for espionage, attribution, and the future of surveillance.

A case study of forged X.509 certificates used to intercept logins to Cisco SSL VPNs at U.S. government networks. Learn how the technique connects to proxy infrastructure and how JA4 fingerprinting can help defenders detect and disrupt similar attacks.

PANELIST: Faster Than Our Guardrails - AI on Offence, Defence and Everything in Between

Explore how Windows access tokens govern permissions, follow processes and threads, and enable impersonation. Learn how attackers abuse tokens to escalate privileges—and what defenders can monitor to spot misuse.

This talk explores AI’s benefits and pitfalls in malware analysis, emphasizing the role of domain expertise. Using LegionLoader as a case study, it covers agent-assisted unpacking, C2 analysis, and extraction of cryptographic keys and indicators.