CONTENT »

Talks


ROOTCON 20 talks bring together offensive research, threat intelligence, AI security, cloud tradecraft, embedded systems, and practical lessons from real-world security work.


0-Day and N-Days in AI/ML Supply Chain Frameworks

Track 2
Speaker: Aden Yap

AI/ML platforms are rapidly becoming core components in modern engineering stacks, yet their LLMOps and MLOps frameworks remain under scrutinized and increasingly attractive to attackers. This talk presents the real world discovery of multiple high severity vulnerabilities in two popular open source platforms, Mage-AI(8.7k GitHub star) and Dify (144k GitHub star). We outline how misconfigurations, insecure defaults, and overlooked web components create practical exploitation paths, and how a structured methodology using Huntr, GitHub reconnaissance, and OWASP Top 10 testing led us to these findings. The session highlights a zero click RCE in Mage AI and multiple Broken Access Control flaws in Dify, supported by PoC demonstrations and internet wide exposure analysis via Shodan, Censys, and custom Nuclei templates. Attendees will gain practical insights into evaluating AI frameworks, identifying systemic weaknesses, and improving the security posture of AI integrated environments.


Beyond the Checkbox: How to Engineer Emulations That Actually Matter

Track 1
Speaker: Pengfei Yu

At ROOTCON 19 I talked about what purple teaming programmes are, how to start building them, and all the ways I've personally seen them go wrong. But there's a question that talk didn't answer: once you have the programme running, how do you actually engineer the emulations themselves?

Most purple teams run emulations that amount to firing ATT&CK techniques by ID and checking whether the SIEM lit up. Technique executed, alert fired, green checkbox, move on. Nobody stops to ask whether they're testing the right technique for their environment, whether the detection they triggered would actually catch the real thing, or whether the five techniques they skipped would have been the ones that mattered. The programme is running, the buy-in is there, the tooling is there, and the emulations still don't test what matters.

This talk treats adversary emulation engineering as a structured capability, one that turns threat intelligence into safe, repeatable tests that exercise specific detection surfaces in your defensive stack. We'll walk through how to scope and prioritise emulations against your actual threat landscape, how to decompose TTPs into the detection opportunities they create rather than just executing techniques for the sake of it, and how to engineer safe reproductions that test the right things without blowing up production.

The worked example throughout is Iran's wartime cyber operations in 2026, drawn from public threat intelligence reporting on concurrent state-directed campaigns. When multiple actor clusters light up simultaneously with completely different tradecraft, the scoping problem becomes genuinely hard and the methodology has to earn its keep. You'll walk away with a repeatable decision model for turning any threat report into a prioritised emulation plan that tests what actually matters in your environment.


Bridging Trust to Root: Offensive Research into Industrial Couplers

Track 2
Speaker: Omkar Mali

As renewable energy infrastructure rapidly scales worldwide, the industrial edge devices enabling communication between field equipment and operational networks are becoming increasingly critical and increasingly exposed. Serial-to-Ethernet couplers, widely deployed alongside solar inverters, telemetry gateways, and industrial monitoring systems, serve as trusted bridges between legacy protocols such as RS485/Modbus and modern IP-based infrastructure. Despite occupying privileged positions inside operational environments, these communication bridges often receive little to no security scrutiny. This research presents an offensive analysis of industrial couplers deployed in renewable energy environments, focusing on hardware teardown, SPI flash extraction, firmware reverse engineering, credential recovery, and post-exploitation analysis of exposed management services. Our findings reveal insecure firmware storage, plaintext and hardcoded credentials, weak or absent authentication controls, exposed remote administration interfaces, and root-level service access that can enable full device compromise. Once controlled, these devices may be abused as strategic footholds for telemetry manipulation, protocol redirection, remote configuration tampering, denial of visibility, and lateral movement deeper into OT networks. Beyond direct compromise, our investigation highlights a broader systemic concern: communication paths between embedded devices, mobile applications, cloud platforms, and remote management infrastructure frequently traverse opaque trust boundaries with minimal security validation. In renewable infrastructure, where operational continuity directly impacts energy reliability, compromise of these overlooked bridge devices may introduce disproportionate operational, privacy, and strategic risk. This talk demonstrates why some of the smallest components in modern green infrastructure may represent some of its most valuable offensive targets.


Build Your Red Team AI Crew: One Prompt vs Five Agents

Track 1
Speakers: Ariz Soriano, Hebe Au

Multiple AI coding platforms can now generate offensive tooling, but there is no published data measuring whether the multi-agent orchestration frameworks layered on top of them actually produce better code than a well-prompted single run in the same IDE. Operators who build red team tools with AI pick between "one good prompt" and "five-stage pipeline" on vibes. This talk replaces vibes with numbers.

We pre-registered three research questions and ran a structured comparison across four use cases. Same PROMPT per tool across four conditions: Claude Code with one comprehensive prompt; Claude Code with a five-agent pipeline (Domain Researcher, Planner, Ops Advisor, Tool Architect, OPSEC Reviewer); OpenAI Codex with the same pipeline in AGENTS.md form; and Codestral running locally via CrewAI, fully air-gapped. All four share the same MCP scanner set (Semgrep, ast-grep), the same coding-aid MCP (Serena, for language-server-backed code navigation and editing), and a six-dimension evaluation rubric covering correctness, API fidelity, OPSEC depth, code quality, completeness, and time-to-working-implementation. The only variable is the scaffolding.

We built four reference tools that span an engagement lifecycle and stress the scaffolding in different ways. A Chrome MV3 extension that tracks auth flows, generates evilginx phishlets, clones pages with clickfix and filefix injection, and produces malleable C2 profiles. An augmented GoPhish that delivers ICS calendar invites with RSVP telemetry. An Empire plugin that intercepts operator commands and scores them against EDR behavior with quieter alternatives. An after-action collector that correlates logs and decisions into client reports and internal learning summaries. These are the boring-but-critical tools operators build by hand today and deprioritize on every engagement. Sixteen total runs. Same prompts. Same scanners. Same rubric.

Three answers with receipts: does the pipeline beat a single prompt in the same IDE, does the methodology transfer from Claude Code to Codex, and how far does the pipeline stretch a weaker local model for budget-constrained or air-gapped teams. We ship whatever the data says, including findings that make our own methodology look bad. Attendees leave with a public methodology repo (four condition configurations, the canonical agent persona files, raw outputs from all sixteen runs, and the comparison spreadsheet that doubles as the failure log) plus four separate tool repos (one per reference tool), each carrying its own build instructions and OPSEC card. Each OPSEC card includes a Detection Recommendations section, written from the operator's perspective as the defender-side guidance a red team report would deliver to a client. The same artifact a defender uses to build detections is the artifact the operator hands the client at engagement close, which means the detection guidance is generated as part of the red team workflow rather than as a separate blue-team afterthought.


Counter Strike: When Zigbee's Anti-replay becomes the attack

Track 2
Speaker: Smriti Gaba

Zigbee is deployed in hundreds of millions of devices - smart homes, offices, hospitals, warehouses. Human presence detection sensors are among the most trusted components in these networks, feeding occupancy data to security systems, access control and automation logic. The protocol includes an anti-replay mechanism specifically designed to prevent packet injection. The same mechanism becomes the foundation of the attack chain presented in this talk.

This talk walks through a complete offensive chain against a production zigbee 3.0 human presence detection sensor and the zigbee coordinator bridge - from passive key extraction through a fully working AES-128-CCM packet injection to something unexpected: a fully controlled DoS that takes the sensor offline on demand for any chosen duration and brings it back at will. No RF jamming, No indication of anything went wrong. A space can be entered, an alarm bypassed, a physical intrusion completed and when the sensor comes back every system above it resumes as normal as if nothing happened.


Ctrl + Flow + Esc: Escaping Red Team Chaos

Track 1
Speakers: Yi Ting Shen, Ariz Soriano

Modern red team and bug bounty operations are increasingly powered by advanced tooling, automation, and AI-assisted reconnaissance. However, despite this growth in capability, security teams continue to struggle with a less visible but more fundamental problem: fragmented information flow. Findings are scattered across tools, context is frequently lost between stages of investigation, and decision-making becomes inconsistent as intelligence is duplicated, buried, or never properly connected.

In practice, offensive security work is no longer limited by the ability to discover vulnerabilities, but by the inability to structure and maintain coherent operational context across the entire workflow. Recon outputs, validation results, and reports exist as isolated artifacts rather than parts of a continuous system, leading to inefficiencies, missed signals, and scaling challenges in real-world red team operations.

In this presentation, we explore red teaming from a systems perspective and argue that the core bottleneck lies in the absence of structured intelligence flow rather than a lack of tools. We introduce BountyFlow, a workflow-centric approach designed to transform fragmented offensive security data into connected, traceable, and actionable intelligence.

BountyFlow models red teaming as a continuous flow of information rather than a collection of discrete tasks. By structuring, linking, and preserving context across recon, analysis, and reporting stages, it enables teams to reduce noise, avoid duplicated effort, and maintain clearer operational awareness. We demonstrate how this approach changes the way offensive security work is conducted in practice, and how shifting from tool-centric execution to flow-centric intelligence can fundamentally improve red team efficiency and decision-making.


Following the Shell: From Packed Loader to Vshell

Track 1
Speakers: Duc Kien Nguyen, Doan Minh Long

TA-SC-31 which also know as Earth Lamia is an advanced persistent group that is reported to actively targeting South Asia. Viettel Threat Intelligence have managed to identify a new campaign with leaked vshell, used of slow#tempest loader and extensive use of themida to pack tool and sample.

In this presentation, we uncovered a new campaign by the threat actor which target large enterprise in South Asia including Philippines, Vietnam, India and Thailand. We first analyze the malware malicious including unpacking themida with anti-dump, deobfuscating ollvm with indirect branching + control flow flattening and finally analyze the final golang payload.

In the second part of the talk, we will dive into detail how we attribute the threat actor with multiples campaigns from information such as active time, CnC server, victimology, attack techniques. The information has been gathered from each of the threat actor campaign from 2025 up until now. And then we managed to write a tool in order to mass scan for vshell sample and managed to identified threat actor CnC in the wild before they appear.

Finally, we give the information on how to prevent and detect any attacking attempt by the threat actor group from the malware the threat actor use to detect and prevent the attacking surface of the threat actor.


In Cloud We Trust: Modifying Cloud Service Providers (CSP) Agents for C2

Track 1
Speakers: Yeonwoo Park, Sunggwan Choi

This research examines how the remote access, monitoring, and CI/CD services that Cloud Service Providers offer, along with open-source agents they provide, can be modified for stage 0 and persistence payloads. Specifically, we analyzed the operations, architecture, and the source code of open-source agents related to SSM, CI/CD pipelines, and OSConfig provided by AWS, Azure, and GCP. Based on the analysis, we explain how to modify the source code of open-source agents to repurpose them for red team attacks.

Cloud Service Providers (CSPs) offer remote access and monitoring services for on-premises and multi-cloud systems to facilitate operations. Specific examples include the AWS Systems Manager, the Azure CI/CD Pipelines, and the GCP OSConfig. The agents used in these services are often open-sourced and are built on long-trusted codebases and communicate with trusted CSP endpoints. In addition, these agents often provide functionalities frequently used by C2 agents, such as interactive shells, file transfer, port forwarding, and tunneling. These characteristics allow attackers to evade detection and maintain a stable connection by leveraging trusted channels.

To provide practical and technical proof of concept, this research developed three tools, one for each CSP (AWS, Azure, GCP) that repurposed these trusted opensource agents into red team payloads:

1. EvilSSM: Modifies the source code of the AWS SSM Agent to create a single portable binary that can run even with low privileges, enabling command execution, interactive sessions, and port forwarding through the AWS SSM service 2. EvilAzp & EvilAzp-Agent: Modifies the source code of the Azure Pipelines Agent to execute commands as a single binary; incorporates code from MS Dev Tunnels and Azure Relay Bridge and packages them as plugins 3. EvilOSConfig: Modifies the GCP OS Config Agent to execute remote commands via GCP OS Policy and optional Pub/Sub-based tasking.

This session will cover the engineering patterns, demo videos, and defensive implications for each project. Following the presentation, EvilSSM, EvilAzp/Agent, and EvilOSConfig will all be released as open source on GitHub.

Outline:

1. Introduction: Cloud Services, Agents, and Trade-offs - Brief overview of targeted cloud services, opensource agent architecture, and execution methods - Previous Research - Abusing CSP Agents, and their limitations - Differences between LOLRMM (Living off the Land - Remote Management and Monitoring) and LOTS (Living Off Trusted Sites) - Pros and cons of using CSP Agents vs. Traditional commercial/opensource C2 Agents - Potential Use Cases: Stage 0 and Persistence

2. AWS: EvilSSM - Description, structure, execution method, and artifacts - Code Modification - Simplification: removing user-privilege checks, service creation, path dependencies, etc. - Code Modification - Single Binary: Reducing the number of required binaries through source code modification - Utilization as Stage 0 via RunCommand, Session Manager, RDP, and Port Forwarding - Demo Video (1–2 minutes): Running EvilSSM -> Executing commands using SSM and a helper Python script, port forwarding, pseudo-SOCKS, etc.

3. Azure: EvilAzp & EvilAzp-Agent - Description, structure, and execution method of the Azure CI/CD Pipeline Agent - Code modification - Single binary and baked configuration - Code modification - Incorporating Dev Tunnels & Azure Relay Bridge code as plugins - Demo video (1–2 minutes): Execute EvilAzp -> Execute commands, port forwarding via Dev Tunnels/Azure Relay Bridge

4. GCP: EvilOSConfig - Description, structure, execution method, and command execution method of OSConfig - Code modification - Registration: Structure of the Metadata Server and GCE identity proxying to bypass it - Code modification - Command execution: Command execution based on OS Policy and returning command output - Code modification - Pub/Sub: Slightly faster command execution via Google Publisher/Subscriber - Demo Video (1–2 minutes): Command execution via EvilOSConfig

5. Defender Perspective - Challenges - Behavior: Relationships between endpoints and network endpoints - IoCs: host artifacts such as directories, files, logs, and code signing


Instant yara signatures

Track 2
Speaker: Rick Wesson

rewriting yara in golang with the help of ai to enable tow capabilities: scanning streams and writing its own signatures. Its a fun project, you can follow allong at https://plan10.org/

I didn't think it was possable to take an opensource project and recompose it to my vision with almost zero programming. I learned alot about working with AI and peered into the future of open source.


IPAHound. Walking along the edges in FreeIPA

Track 1
Speaker: im10n Mikhail

I have developed and released the FreeIPA - IPAHound security analysis tool. In the report, I would like to share information that was not included in the article on PT swarm (https://swarm.ptsecurity.com/thinking-in-graphs-with-ipahound/). I also have experience speaking about FreeIPA on OffZone and CVEs in FreeIPA (CVE-2025-4404, CVE-2024-3183). The report will examine: the abuse of trust between FreeIPA and AD, the complex abuse of delegation and its types in FreeIPA, how to search for attack vectors through IPAHound and analyze the graph, and much more. Let's look at what you can get after compromising the hosts.


Khmer Shadow: Uncovering a Targeted Cyber Espionage Campaign Against Cambodian Military Intelligence

Track 1
Speaker: Subhajeet Singha

In 2026, Acronis Threat Research Unit discovered a new and unidentified APT group, collectively tracked as Khmer Shadow, responsible for two distinct targeted cyber espionage campaigns directed at high-value government institutions in Cambodia. In a significant finding, one of these campaigns includes confirmed targeting of the Information Collection Bureau (ICB) within Cambodia's Ministry of National Defence, the country's primary military intelligence organ, marking a rare instance of a threat actor directly spearphishing named personnel within a Southeast Asian military intelligence bureau. Alongside this, the campaigns also targeted the Ministry of Public Works and Transport, reflecting a broad collection mandate spanning both defense intelligence and strategic infrastructure. The threat actor, assessed with moderate confidence as a Chinese state-sponsored actor, employed precision spear phishing lures constructed around a fabricated Chinese development and investment persona, with decoy documents referencing real named personnel within the targeted bureaus, including an identified contact at the ICB/MOD. This level of specificity indicates prior reconnaissance and a deliberate, intelligence-driven target selection process consistent with Chinese state collection priorities in Southeast Asia.

Both campaigns delivered a sophisticated custom loader, which we have named NightForge, that executed a multi-stage infection chain culminating in the deployment of a Havoc C2 agent on compromised systems. NightForge reflects significant technical investment, employing multiple layers of defense evasion to ensure stealthy execution on targeted systems. It actively works to neutralize security tooling present on the host before executing the final payload, and uses an encrypted payload stored under a machine-specific filename within a legitimately themed staging directory to hinder both detection and cross-victim correlation. This level of engineering demonstrates the actor's deliberate focus on operational security and long-term access.

This presentation will guide attendees through the entire attack chain across both campaigns, covering the multiple threat vectors employed in each. We will examine technical aspects in depth, from the maturity and evasion capabilities of NightForge to the mechanics of its payload decryption and execution, alongside detailed contextual analysis of the initial spearphishing lures and decoy documents. We will explore the geographical focus on Cambodian government institutions and the deliberate selection of victims, offering insight into why Cambodia's military intelligence bureau and infrastructure ministry represent high-value targets under Chinese state collection priorities. The discussion will also include OSINT-based perspectives on the threat actor, along with pivoting related to the infrastructure,examining indicators of prior reconnaissance reflected in the precision of lure construction and the naming of specific personnel within targeted bureaus.

Finally, we will delve into the process of hunting the campaign's infrastructure, detailing how pivoting on Havoc C2 artifacts and NightForge delivery chain indicators across both campaigns led to a series of compelling infrastructure discoveries and interconnected pivots, ultimately supporting attribution to a Chinese state-sponsored actor. Attendees will gain a clear understanding of Khmer Shadow's methods, the technical maturity of NightForge, the geopolitical rationale behind target selection, and actionable detection guidance for identifying this threat in their environments.


LOTIDE Unleashed: Weaponizing the Full Attack Lifecycle Against AI-Assisted IDEs

Track 2
Speakers: Edo Maland, Arv Arvandy

AI-assisted code editors like Cursor, Antigravity, Bob and other agentic coding IDEs are rapidly becoming standard across development teams. These tools do far more than autocomplete code. They read repositories, execute workspace tasks, render diagrams and Markdown inside embedded webviews, store searchable chat history, and establish authenticated development tunnels.

In this talk, we show how AI-assisted IDEs can be exploited and abused across the full intrusion lifecycle, a concept we call LOTIDE (Living Off the IDE) that can be utilized during adversary emulation or red teaming engagements. We demonstrate practical attack paths beginning with initial access, walking through how attackers can compromise a vibe coder or developers through common vulnerabilities, supply chain attacks, malicious repositories, and workspace auto-execution, continuing through prompt injection and the novel one-click exploitation of the IDEs' remote orchestration layer that specifically forces arbitrary command execution.

These flows continue with credential harvesting and culminate in covert data exfiltration and command-and-control over built-in developer tunnels. None of this relies on memory corruption or custom implants. The techniques abuse legitimate features and blend into normal developer workflows.

To operationalize this, we also introduce an automation toolkit that discovers and enumerates AI-assisted IDEs within an environment and performs post-exploitation operations against them.

A modern AI-assisted IDE is no longer just a productivity tool. In the wrong hands, it becomes a high-value intrusion platform for an attacker's tradecraft.


Operation Dragon Weave: Uncovering a China-Linked Multi-Stage Campaign Abusing Azure Cloud Infrastructure as Command and Control

Track 2
Speaker: Priya Patel

This research presents a technical analysis of a previously undocumented espionage campaign attributed to a Chinese-origin threat actor targeting government-affiliated individuals across Czech Republic and Taiwan, tracked as Operation Dragon Weave. The campaign employs a dual-path delivery mechanism combining LNK-based spearphishing with a self-contained Rust-compiled dropper, both converging on the same multi-stage execution chain. At the core is RUSTCLOAK, a custom Rust-based loader implementing a triple-layer decryption chain — modified RC4, Base64, and SM4-CBC — using fiber-based shellcode execution via CreateFiberEx and SwitchToFiber to evade user-mode security tools, combined with sandbox detection against 100+ known analyst machine names.

This research contributes the first public technical documentation of Adaptix C2 being deployed with Azure Blob Storage as the transport layer, the first observed combination of SM4 encryption with the Adaptix framework, and the identification of COFF/BOF loader capabilities within the Adaptix agent not previously described in public threat intelligence. The TTPs observed show the closest overlap with APT-Q-27 (Dragon Breath / Golden Eye Dog) while incorporating novel tooling and techniques not previously attributed to any known threat actor, suggesting either a new subgroup or significant retooling of an existing Chinese APT's offensive capability.


Qillin be Killing it

Track 2
Speaker: Salimah Liyakkathali

Qilin (also known as Agenda) has quietly matured into one of the most operationally efficient ransomware operations observed in recent incident response investigations. While it lacks the hype of larger ransomware brands, IR cases consistently show Qilin succeeding through disciplined tradecraft, fast execution, and a clear understanding of enterprise environments. Multiple victims across different sectors have been impacted by this actor.

In this presentation, we will walk through real‑world incident response cases involving Qilin to examine how the group operates in practice, what tactics they are currently leveraging, and how their activity has evolved.


Reconstructing Red Team Engagements: Developing Your Own Red Agent

Track 2
Speakers: Jun Miura, Takao Homma

With recent advances in AI technology, large language models (LLMs) are increasingly being applied to red team engagements. Most existing use cases, however, focus primarily on automating or streamlining operations during the engagement itself. The potential of LLMs extends far beyond operational assistance. To address this, "Red Agent" was developed as an AI agent framework designed to enhance and optimize the entire lifecycle of red team engagements with local LLMs. In a typical engagement workflow, blue team members implement remediation measures based on the final report after the engagement is completed. Evaluating the effectiveness of those mitigations often becomes a major bottleneck, as both blue and red team members must spend significant time interpreting findings, reproducing attack paths, and validating defensive improvements. Red Agent focuses specifically on automating and accelerating this follow-up process, significantly reducing the manual effort required from both teams. At the same time, the introduction of Red Agent required optimization of engagement artifacts produced by the red team, including operational logs, reporting structures, and knowledge management practices. By continuously accumulating refined operational data and applying it to tasks such as model training and workflow automation, Red Agent can also support activities during future engagements. As a result, Red Agent reconstructs the lifecycle of red team engagements by redefining the division of responsibilities between human operators and AI-driven systems. This allows red team members to focus on higher-value and more advanced operations while improving the overall effectiveness of the engagement process. This talk presents the architecture and implementation details of Red Agent, along with practical demonstrations and real-world case studies from its deployment.


Securing Space: Threat Assessment and Remediation Analysis for Nanosatellite On Board Computers

Track 1
Speaker: Davis Zheng

CubeSats are democratizing access to space, but their reliance on legacy code, exposed debug ports, and insecure comms makes them an avenue of attack for attackers. This session presents a structured approach to threat modeling for Nanosatellite On-Board Computers (OBCs), combining MITRE EMB3D’s hardware-aware taxonomy with TARA’s mission-critical risk assessment. Learn how common pre-launch oversights can cascade into post-launch compromises, and why defense-by-design isn’t optional in orbit.


SEG fault - when 2 email parsers disagree

Track 1
Speaker: Artem Danilov

A large number of cyber attacks begin with malicious file mailings or phishing, the Secure Email Gateway product class is designed to protect employees from such attacks, however, due to insufficiently strict restrictions in RFC 5322, many SEG products can be circumvented. RFC 5322, which defines the MIME encoding standard, does not cover many boundary situations that may arise when parsing incoming messages, which is why parser developers must independently think through and implement the parsing logic. If the parsing of messages and attachments on the security tool does not match the parsing algorithm on the end user's mail server or mail client, then it is possible to bypass the security tool and deliver the malicious attachment to the end user. Several workarounds due to incorrect SMTP proxy configurations will also be presented. The report will focus on the found ways to bypass Russian commercial SEG, popular open source SEG, and SEG bypasses in Russian mail providers. Let's talk about the causes of these crawls and how to protect corporate email.


The Ghost in the Rack

Track 1
Speaker: Alex Bazhaniuk

Modern AI security discussions are dominated by prompt injection and model poisoning—threats that live in the software ether. Yet, we often ignore the massive physical infrastructure that powers these models. This talk dives deep into the "AI basement," exploring the firmware, controllers, and interconnects of the hardware stack. From the NVIDIA GB200 and Blackwell GPUs to Bluefield-3 DPUs and Groq LPU architectures, we will map the expanded attack surface of AI-scale compute. We’ll reveal how legacy protocols and components like UEFI, BMC, and IPMI—never intended for AI workloads—create a dangerous security debt. Ultimately, we argue that your model’s integrity is only as strong as the firmware in the rack beneath it.


The silent threat of IMSI-catchers in the age of 5G

Track 1
Speaker: Altaf Shaik

IMSI-catchers are small devices that trick phones into connecting to them instead of real cell towers, and they’re fast becoming a major security headache across Asia. In 2024, Japan, Thailand, and the Philippines all reported cases where these gadgets tracked protesters, spied on officials, and put public safety at risk. Police have shut down several illegal setups, but the problem keeps spreading: low-cost units from China are now turning up in Gulf, Europe and the UK. A single device costs only a few thousand dollars, slips easily into a car or backpack, and can be hard to detect without specialized tools.

5G was built with stronger encryption and hidden subscriber IDs to stop attacks like these, but our recent tests show many operators leave the key safeguards unfinished or switched off, so IMSI catchers can still fool 5G phones. There is still no clear standard for spotting rogue towers, leaving most networks blind to IMSI-catchers in real time.

This presentation gives telecom operators, regulators, security teams, and law-enforcement agencies a practical roadmap to solve the problem. It shows how to boost network visibility, activate missing 5G protections, deploy IMSI-catcher detectors, and coordinate rapid responses when fake towers appear.


Using AI for CTFs, and creating AI resistant challenges

Track 1
Speaker: Ellwood Thewood

AI is rapidly changing the landscape of CTF events, from assisting players in solving challenges automatically with a 'pay to win' mindset, to also helping organizers generate new CTF challenges. This talk explores both sides of this evolution, from how competitors are already using LLMs and integrations to automate solving and submitting challenges, and how CTF designers can begin to a near term future of AI-assisted participants. This presentation first covers practical examples of using AI against CTF platforms with APIs.

The second part will focus on creating AI resistant challenges and measuring the impact of AI assisted teams or individuals on competitive balance. Topics include prompt poisoning techniques, intentional instruction triggering inputs and outputs, and alternate flag paths that can be used in collecting metrics for solves. Additionally, methods to include physical world challenges that would need to be solved by a human instead of a LLM system such as lockpicking challenges or badge challenges.