COUNTERMEASURE26 Talk

This talk examines how AI can build and analyze social graphs of adversarial networks, using China’s vulnerability research ecosystem as a case study. It explores how incomplete or leak-skewed data can distort graph algorithms—and how analysts can mitigate these pitfalls.

Military AI can aid high-stakes decisions, but visible reasoning may not reflect how newer models reach conclusions. This talk examines the resulting trust gap and explores alternatives to chain-of-thought for meaningful human oversight.

This talk traces an unusual surveillance operation tied to a real-world event, combining infrastructure analysis, OSINT, and on-the-ground context to reveal a novel commercial-spyware infection vector and explore its implications for espionage, attribution, and the future of surveillance.

A case study of forged X.509 certificates used to intercept logins to Cisco SSL VPNs at U.S. government networks. Learn how the technique connects to proxy infrastructure and how JA4 fingerprinting can help defenders detect and disrupt similar attacks.

To Be Announced

Explore how Windows access tokens govern permissions, follow processes and threads, and enable impersonation. Learn how attackers abuse tokens to escalate privileges—and what defenders can monitor to spot misuse.

This talk explores AI’s benefits and pitfalls in malware analysis, emphasizing the role of domain expertise. Using LegionLoader as a case study, it covers agent-assisted unpacking, C2 analysis, and extraction of cryptographic keys and indicators.

This session examines proxy and relay infrastructure used to collect and exfiltrate geospatial data, covering its design, purpose, daily operations, national security implications, network observations, and potential attribution of backend interfaces.

Cybersecurity’s autonomous capabilities often operate in silos. Introducing Autonomous Mission Assurance: a human-governed architecture connecting development, operations, validation, compliance, remediation, and monitoring through shared context, evidence, orchestration, and bounded autonomy.

CCCS presents an LLM-driven purple-team pipeline that automates detection engineering, adversarial testing, telemetry validation, hardening, and triage. The talk examines architecture, failure modes, and which capabilities genuinely improved analyst effectiveness.