CTI Village at c0c0n 2026

Ransomware groups invest heavily in technical operational security. Brain Spider was no exception. What they failed to account for was their people.

This paper presents the findings of a sustained Human Intelligence operation conducted between 2021 and 2023 against the Brain Spider ransomware affiliate network, the criminal enterprise behind RADAR ransomware and affiliated 8Base operations. Through constructed personas and sustained engagement across restricted-access cybercriminal forums, the operation achieved undetected access to the group's internal communications, live infrastructure, and complete offensive tooling repository a minimum of twelve months before any public attribution or law enforcement action.

Everyone deletes the sextortion email. “I hacked your webcam, I have footage, pay me $1,200 in Bitcoin.” It’s a scam. Everyone knows it’s a scam.

Except this time, the malware is real. And the email is the least profitable part.

I reverse engineered a campaign hiding a multi-revenue ecosystem behind a lure nobody takes seriously. The dropper profiles the victim machine and deploys up to eight payloads. Five are spam engines: two templates, five files, each with a different hash generated by a builder in seconds. If antivirus catches three, the other two still run. Each turns the victim’s machine into a self-contained email cannon, blasting thousands of messages to harvested credential lists without calling back to a command server. No C2. Fire and forget.

Crime Stoppers targets the human perpetrators behind cybercrime, not software vulnerabilities or security flaws. It is seeking information about the specific targets named in our active Operation Silent Vector bounties.

In the fast-paced world of cybersecurity, staying ahead of emerging threats requires constant monitoring of security blogs, research papers, and vulnerability disclosures. However, the sheer volume of information can easily overwhelm manual review. This hands-on workshop demonstrates how to deploy autonomous AI Agents (Agentic AI) as intelligent research assistants to automatically aggregate, analyze, and prioritize threat intelligence.

Adversary infrastructure is evolving faster than our defenses. From dynamic redirects and DNS abuse to cloud-hosted delivery layers, attackers now operate like distributed service providers. This session uncovers how threat actors design, deploy, and protect their infrastructures and how defenders can turn these same tactics into intelligence advantages.

Drawing on real-world investigations, we'll examine how advanced evasion mechanisms such as TDS chains, geofencing, and DNS-based cloaking are used in phishing, malware, and loader campaigns. Through three case studies, we'll explore techniques for mapping attacker ecosystems, identifying shared assets, and correlating threat activity across campaigns.

Participants will leave with actionable workflows: how red teams can emulate such evasive setups for realistic testing, how blue teams can detect and disrupt them, and how threat intel teams can extract and operationalize infrastructure-based intelligence.

Cyber Threat Intelligence has evolved from collecting indicators of compromise to understanding adversary techniques and behavioural patterns. AI agents are forcing the next step: understanding orchestration, including how software selects tools, reacts to failure, crosses trust boundaries, and chains familiar techniques at machine speed.

Using the 2026 OpenAI–Hugging Face incident as a visual investigation, this session reconstructs how meaningful behaviour emerged from approximately 17,600 machine-generated actions over four and a half days. It examines what traditional indicators reveal, what they miss, and why speed or technical sophistication can no longer be treated as reliable evidence of actor identity.

The session then builds a practical AI-assisted CTI workflow for structuring evidence, clustering related activity, mapping behaviours, generating hunting hypotheses, and translating validated intelligence into detections. It also identifies where AI remains unreliable, including hallucinated mappings, weak provenance, and false confidence. Attendees will leave with an Agentic CTI Hunt Canvas for recognizing the sequences, pivots, and coordination patterns that static indicators cannot capture.

Every malware sample leaves fingerprints — some an attacker can change in seconds, others that quietly betray the developer behind the keyboard. This hands-on session teaches analysts how to read those fingerprints and turn a lone sample into actual intelligence: which family it belongs to, who else it's related to, and whether you've seen it before.

It started with a compromised GitHub repository.

Inside it was a VS Code task that had no obvious reason to exist. It had survived in the repository for months, waiting for a developer to open the project. Following its execution led to a WOFF2 font file. The font was not a font.

Buried inside it was a heavily obfuscated JavaScript loader. Reverse engineering the loader uncovered a second-stage Node.js payload, but there was something missing: no conventional C2 address.

Instead, the malware was watching Ethereum.

A hardcoded wallet was being used as a dead drop. The malware monitored blockchain transactions, extracted data encoded into recipient addresses, and used that data to discover its next C2 infrastructure. What looked like ordinary blockchain activity became the mechanism for rotating command-and-control servers.

That pivot changed the investigation. From the compromised repository, the trail moved through a malicious VS Code task, a weaponized WOFF2 file, obfuscated JavaScript, an Ethereum wallet, blockchain transactions, and a constantly changing C2 layer. Infrastructure pivots and malware-level artifacts eventually connected the activity to the PolinRider and NullReceiver ecosystem associated with DPRK-linked operations.

This talk reconstructs that investigation from the first suspicious GitHub artifact to the final infrastructure pivots, showing how a supply-chain compromise concealed an unusual blockchain-based C2 mechanism in plain sight.