As Large Language Models become integrated into critical business applications, the attack surface for organizations is shifting. This training covers applied strategies for manipulating and red teaming the probabilistic nature of AI systems.

Before cybersecurity became a global industry, it was a community.

It lived in IRC channels, underground forums, shared exploit code, and conference hallways at gatherings like ROOTCON and Hack In The Box. It was driven not by budgets or compliance frameworks, but by curiosity — by people who wanted to understand how systems worked, why they failed, and how to push them further — while having fun along the way.

This keynote traces how grassroots hacker communities evolved from fringe subculture into the architects of modern cybersecurity. Open-source tooling and vulnerability research didn’t just influence the industry — they became it, morphing into startups, bug bounties, and even national cyber capabilities. The hacker underground didn’t disappear — it scaled.

But this is more than a retrospective.

As cybersecurity becomes increasingly institutionalized and AI reshapes the offensive and defensive landscape, we may be witnessing another shift in power. Once again, individuals and small communities are gaining disproportionate leverage. The independent builder is no longer constrained by resources — only by imagination.

What does the next underground look like? How do hacker communities adapt when the tools themselves become intelligent? And who builds the future when curiosity meets exponential amplification?

This talk is both a homecoming and a call forward — a reminder that modern cybersecurity was built by communities, and its next chapter will be shaped by them again.

At ROOTCON 19 I talked about what purple teaming programmes are, how to start building them, and all the ways I've personally seen them go wrong. But there's a question that talk didn't answer: once you have the programme running, how do you actually engineer the emulations themselves?

Most purple teams run emulations that amount to firing ATT&CK techniques by ID and checking whether the SIEM lit up. Technique executed, alert fired, green checkbox, move on. Nobody stops to ask whether they're testing the right technique for their environment, whether the detection they triggered would actually catch the real thing, or whether the five techniques they skipped would have been the ones that mattered. The programme is running, the buy-in is there, the tooling is there, and the emulations still don't test what matters.

This talk treats adversary emulation engineering as a structured capability, one that turns threat intelligence into safe, repeatable tests that exercise specific detection surfaces in your defensive stack. We'll walk through how to scope and prioritise emulations against your actual threat landscape, how to decompose TTPs into the detection opportunities they create rather than just executing techniques for the sake of it, and how to engineer safe reproductions that test the right things without blowing up production.

The worked example throughout is Iran's wartime cyber operations in 2026, drawn from public threat intelligence reporting on concurrent state-directed campaigns. When multiple actor clusters light up simultaneously with completely different tradecraft, the scoping problem becomes genuinely hard and the methodology has to earn its keep. You'll walk away with a repeatable decision model for turning any threat report into a prioritised emulation plan that tests what actually matters in your environment.

CubeSats are democratizing access to space, but their reliance on legacy code, exposed debug ports, and insecure comms makes them an avenue of attack for attackers. This session presents a structured approach to threat modeling for Nanosatellite On-Board Computers (OBCs), combining MITRE EMB3D’s hardware-aware taxonomy with TARA’s mission-critical risk assessment. Learn how common pre-launch oversights can cascade into post-launch compromises, and why defense-by-design isn’t optional in orbit.

Modern red team and bug bounty operations are increasingly powered by advanced tooling, automation, and AI-assisted reconnaissance. However, despite this growth in capability, security teams continue to struggle with a less visible but more fundamental problem: fragmented information flow. Findings are scattered across tools, context is frequently lost between stages of investigation, and decision-making becomes inconsistent as intelligence is duplicated, buried, or never properly connected.

In practice, offensive security work is no longer limited by the ability to discover vulnerabilities, but by the inability to structure and maintain coherent operational context across the entire workflow. Recon outputs, validation results, and reports exist as isolated artifacts rather than parts of a continuous system, leading to inefficiencies, missed signals, and scaling challenges in real-world red team operations.

In this presentation, we explore red teaming from a systems perspective and argue that the core bottleneck lies in the absence of structured intelligence flow rather than a lack of tools. We introduce BountyFlow, a workflow-centric approach designed to transform fragmented offensive security data into connected, traceable, and actionable intelligence.

BountyFlow models red teaming as a continuous flow of information rather than a collection of discrete tasks. By structuring, linking, and preserving context across recon, analysis, and reporting stages, it enables teams to reduce noise, avoid duplicated effort, and maintain clearer operational awareness. We demonstrate how this approach changes the way offensive security work is conducted in practice, and how shifting from tool-centric execution to flow-centric intelligence can fundamentally improve red team efficiency and decision-making.

Modern AI security discussions are dominated by prompt injection and model poisoning—threats that live in the software ether. Yet, we often ignore the massive physical infrastructure that powers these models. This talk dives deep into the "AI basement," exploring the firmware, controllers, and interconnects of the hardware stack. From the NVIDIA GB200 and Blackwell GPUs to Bluefield-3 DPUs and Groq LPU architectures, we will map the expanded attack surface of AI-scale compute. We’ll reveal how legacy protocols and components like UEFI, BMC, and IPMI—never intended for AI workloads—create a dangerous security debt. Ultimately, we argue that your model’s integrity is only as strong as the firmware in the rack beneath it.

Multiple AI coding platforms can now generate offensive tooling, but there is no published data measuring whether the multi-agent orchestration frameworks layered on top of them actually produce better code than a well-prompted single run in the same IDE. Operators who build red team tools with AI pick between "one good prompt" and "five-stage pipeline" on vibes. This talk replaces vibes with numbers.

We pre-registered three research questions and ran a structured comparison across four use cases. Same PROMPT per tool across four conditions: Claude Code with one comprehensive prompt; Claude Code with a five-agent pipeline (Domain Researcher, Planner, Ops Advisor, Tool Architect, OPSEC Reviewer); OpenAI Codex with the same pipeline in AGENTS.md form; and Codestral running locally via CrewAI, fully air-gapped. All four share the same MCP scanner set (Semgrep, ast-grep), the same coding-aid MCP (Serena, for language-server-backed code navigation and editing), and a six-dimension evaluation rubric covering correctness, API fidelity, OPSEC depth, code quality, completeness, and time-to-working-implementation. The only variable is the scaffolding.

We built four reference tools that span an engagement lifecycle and stress the scaffolding in different ways. A Chrome MV3 extension that tracks auth flows, generates evilginx phishlets, clones pages with clickfix and filefix injection, and produces malleable C2 profiles. An augmented GoPhish that delivers ICS calendar invites with RSVP telemetry. An Empire plugin that intercepts operator commands and scores them against EDR behavior with quieter alternatives. An after-action collector that correlates logs and decisions into client reports and internal learning summaries. These are the boring-but-critical tools operators build by hand today and deprioritize on every engagement. Sixteen total runs. Same prompts. Same scanners. Same rubric.

Three answers with receipts: does the pipeline beat a single prompt in the same IDE, does the methodology transfer from Claude Code to Codex, and how far does the pipeline stretch a weaker local model for budget-constrained or air-gapped teams. We ship whatever the data says, including findings that make our own methodology look bad. Attendees leave with a public methodology repo (four condition configurations, the canonical agent persona files, raw outputs from all sixteen runs, and the comparison spreadsheet that doubles as the failure log) plus four separate tool repos (one per reference tool), each carrying its own build instructions and OPSEC card. Each OPSEC card includes a Detection Recommendations section, written from the operator's perspective as the defender-side guidance a red team report would deliver to a client. The same artifact a defender uses to build detections is the artifact the operator hands the client at engagement close, which means the detection guidance is generated as part of the red team workflow rather than as a separate blue-team afterthought.

Hacker Karaoke exists for those people. Take the stage and perform in front of fellow hackers, friends, strangers, and people you will probably have breakfast with the next morning. No experience is required, although confidence helps. Some performances become legends. Others become stories told at future ROOTCONs.

IMSI-catchers are small devices that trick phones into connecting to them instead of real cell towers, and they’re fast becoming a major security headache across Asia. In 2024, Japan, Thailand, and the Philippines all reported cases where these gadgets tracked protesters, spied on officials, and put public safety at risk. Police have shut down several illegal setups, but the problem keeps spreading: low-cost units from China are now turning up in Gulf, Europe and the UK. A single device costs only a few thousand dollars, slips easily into a car or backpack, and can be hard to detect without specialized tools.

5G was built with stronger encryption and hidden subscriber IDs to stop attacks like these, but our recent tests show many operators leave the key safeguards unfinished or switched off, so IMSI catchers can still fool 5G phones. There is still no clear standard for spotting rogue towers, leaving most networks blind to IMSI-catchers in real time.

This presentation gives telecom operators, regulators, security teams, and law-enforcement agencies a practical roadmap to solve the problem. It shows how to boost network visibility, activate missing 5G protections, deploy IMSI-catcher detectors, and coordinate rapid responses when fake towers appear.

I have developed and released the FreeIPA - IPAHound security analysis tool. In the report, I would like to share information that was not included in the article on PT swarm (https://swarm.ptsecurity.com/thinking-in-graphs-with-ipahound/). I also have experience speaking about FreeIPA on OffZone and CVEs in FreeIPA (CVE-2025-4404, CVE-2024-3183).
The report will examine: the abuse of trust between FreeIPA and AD, the complex abuse of delegation and its types in FreeIPA, how to search for attack vectors through IPAHound and analyze the graph, and much more. Let's look at what you can get after compromising the hosts.

This research examines how the remote access, monitoring, and CI/CD services that Cloud Service Providers offer, along with open-source agents they provide, can be modified for stage 0 and persistence payloads. Specifically, we analyzed the operations, architecture, and the source code of open-source agents related to SSM, CI/CD pipelines, and OSConfig provided by AWS, Azure, and GCP. Based on the analysis, we explain how to modify the source code of open-source agents to repurpose them for red team attacks.

Cloud Service Providers (CSPs) offer remote access and monitoring services for on-premises and multi-cloud systems to facilitate operations. Specific examples include the AWS Systems Manager, the Azure CI/CD Pipelines, and the GCP OSConfig. The agents used in these services are often open-sourced and are built on long-trusted codebases and communicate with trusted CSP endpoints. In addition, these agents often provide functionalities frequently used by C2 agents, such as interactive shells, file transfer, port forwarding, and tunneling. These characteristics allow attackers to evade detection and maintain a stable connection by leveraging trusted channels.

To provide practical and technical proof of concept, this research developed three tools, one for each CSP (AWS, Azure, GCP) that repurposed these trusted opensource agents into red team payloads:

1. EvilSSM: Modifies the source code of the AWS SSM Agent to create a single portable binary that can run even with low privileges, enabling command execution, interactive sessions, and port forwarding through the AWS SSM service
2. EvilAzp & EvilAzp-Agent: Modifies the source code of the Azure Pipelines Agent to execute commands as a single binary; incorporates code from MS Dev Tunnels and Azure Relay Bridge and packages them as plugins
3. EvilOSConfig: Modifies the GCP OS Config Agent to execute remote commands via GCP OS Policy and optional Pub/Sub-based tasking.

This session will cover the engineering patterns, demo videos, and defensive implications for each project. Following the presentation, EvilSSM, EvilAzp/Agent, and EvilOSConfig will all be released as open source on GitHub.

Outline:

1. Introduction: Cloud Services, Agents, and Trade-offs
- Brief overview of targeted cloud services, opensource agent architecture, and execution methods
- Previous Research - Abusing CSP Agents, and their limitations
- Differences between LOLRMM (Living off the Land - Remote Management and Monitoring) and LOTS (Living Off Trusted Sites)
- Pros and cons of using CSP Agents vs. Traditional commercial/opensource C2 Agents
- Potential Use Cases: Stage 0 and Persistence

2. AWS: EvilSSM
- Description, structure, execution method, and artifacts
- Code Modification - Simplification: removing user-privilege checks, service creation, path dependencies, etc.
- Code Modification - Single Binary: Reducing the number of required binaries through source code modification
- Utilization as Stage 0 via RunCommand, Session Manager, RDP, and Port Forwarding
- Demo Video (1–2 minutes): Running EvilSSM -> Executing commands using SSM and a helper Python script, port forwarding, pseudo-SOCKS, etc.

3. Azure: EvilAzp & EvilAzp-Agent
- Description, structure, and execution method of the Azure CI/CD Pipeline Agent
- Code modification - Single binary and baked configuration
- Code modification - Incorporating Dev Tunnels & Azure Relay Bridge code as plugins
- Demo video (1–2 minutes): Execute EvilAzp -> Execute commands, port forwarding via Dev Tunnels/Azure Relay Bridge

4. GCP: EvilOSConfig
- Description, structure, execution method, and command execution method of OSConfig
- Code modification - Registration: Structure of the Metadata Server and GCE identity proxying to bypass it
- Code modification - Command execution: Command execution based on OS Policy and returning command output
- Code modification - Pub/Sub: Slightly faster command execution via Google Publisher/Subscriber
- Demo Video (1–2 minutes): Command execution via EvilOSConfig

5. Defender Perspective
- Challenges
- Behavior: Relationships between endpoints and network endpoints
- IoCs: host artifacts such as directories, files, logs, and code signing

TA-SC-31 which also know as Earth Lamia is an advanced persistent group that is reported to actively targeting South Asia. Viettel Threat Intelligence have managed to identify a new campaign with leaked vshell, used of slow#tempest loader and extensive use of themida to pack tool and sample.

In this presentation, we uncovered a new campaign by the threat actor which target large enterprise in South Asia including Philippines, Vietnam, India and Thailand. We first analyze the malware malicious including unpacking themida with anti-dump, deobfuscating ollvm with indirect branching + control flow flattening and finally analyze the final golang payload.

In the second part of the talk, we will dive into detail how we attribute the threat actor with multiples campaigns from information such as active time, CnC server, victimology, attack techniques. The information has been gathered from each of the threat actor campaign from 2025 up until now. And then we managed to write a tool in order to mass scan for vshell sample and managed to identified threat actor CnC in the wild before they appear.

Finally, we give the information on how to prevent and detect any attacking attempt by the threat actor group from the malware the threat actor use to detect and prevent the attacking surface of the threat actor.

AI is rapidly changing the landscape of CTF events, from assisting players in solving challenges automatically with a 'pay to win' mindset, to also helping organizers generate new CTF challenges. This talk explores both sides of this evolution, from how competitors are already using LLMs and integrations to automate solving and submitting challenges, and how CTF designers can begin to a near term future of AI-assisted participants. This presentation first covers practical examples of using AI against CTF platforms with APIs.

The second part will focus on creating AI resistant challenges and measuring the impact of AI assisted teams or individuals on competitive balance. Topics include prompt poisoning techniques, intentional instruction triggering inputs and outputs, and alternate flag paths that can be used in collecting metrics for solves. Additionally, methods to include physical world challenges that would need to be solved by a human instead of a LLM system such as lockpicking challenges or badge challenges.

In 2026, Acronis Threat Research Unit discovered a new and unidentified APT group, collectively tracked as Khmer Shadow, responsible for two distinct targeted cyber espionage campaigns directed at high-value government institutions in Cambodia. In a significant finding, one of these campaigns includes confirmed targeting of the Information Collection Bureau (ICB) within Cambodia's Ministry of National Defence, the country's primary military intelligence organ, marking a rare instance of a threat actor directly spearphishing named personnel within a Southeast Asian military intelligence bureau. Alongside this, the campaigns also targeted the Ministry of Public Works and Transport, reflecting a broad collection mandate spanning both defense intelligence and strategic infrastructure. The threat actor, assessed with moderate confidence as a Chinese state-sponsored actor, employed precision spear phishing lures constructed around a fabricated Chinese development and investment persona, with decoy documents referencing real named personnel within the targeted bureaus, including an identified contact at the ICB/MOD. This level of specificity indicates prior reconnaissance and a deliberate, intelligence-driven target selection process consistent with Chinese state collection priorities in Southeast Asia.

Both campaigns delivered a sophisticated custom loader, which we have named NightForge, that executed a multi-stage infection chain culminating in the deployment of a Havoc C2 agent on compromised systems. NightForge reflects significant technical investment, employing multiple layers of defense evasion to ensure stealthy execution on targeted systems. It actively works to neutralize security tooling present on the host before executing the final payload, and uses an encrypted payload stored under a machine-specific filename within a legitimately themed staging directory to hinder both detection and cross-victim correlation. This level of engineering demonstrates the actor's deliberate focus on operational security and long-term access.

This presentation will guide attendees through the entire attack chain across both campaigns, covering the multiple threat vectors employed in each. We will examine technical aspects in depth, from the maturity and evasion capabilities of NightForge to the mechanics of its payload decryption and execution, alongside detailed contextual analysis of the initial spearphishing lures and decoy documents. We will explore the geographical focus on Cambodian government institutions and the deliberate selection of victims, offering insight into why Cambodia's military intelligence bureau and infrastructure ministry represent high-value targets under Chinese state collection priorities. The discussion will also include OSINT-based perspectives on the threat actor, along with pivoting related to the infrastructure,examining indicators of prior reconnaissance reflected in the precision of lure construction and the naming of specific personnel within targeted bureaus.

Finally, we will delve into the process of hunting the campaign's infrastructure, detailing how pivoting on Havoc C2 artifacts and NightForge delivery chain indicators across both campaigns led to a series of compelling infrastructure discoveries and interconnected pivots, ultimately supporting attribution to a Chinese state-sponsored actor. Attendees will gain a clear understanding of Khmer Shadow's methods, the technical maturity of NightForge, the geopolitical rationale behind target selection, and actionable detection guidance for identifying this threat in their environments.

A large number of cyber attacks begin with malicious file mailings or phishing, the Secure Email Gateway product class is designed to protect employees from such attacks, however, due to insufficiently strict restrictions in RFC 5322, many SEG products can be circumvented.
RFC 5322, which defines the MIME encoding standard, does not cover many boundary situations that may arise when parsing incoming messages, which is why parser developers must independently think through and implement the parsing logic. If the parsing of messages and attachments on the security tool does not match the parsing algorithm on the end user's mail server or mail client, then it is possible to bypass the security tool and deliver the malicious attachment to the end user. Several workarounds due to incorrect SMTP proxy configurations will also be presented.
The report will focus on the found ways to bypass Russian commercial SEG, popular open source SEG, and SEG bypasses in Russian mail providers. Let's talk about the causes of these crawls and how to protect corporate email.

The talks are finished, the flags are captured, and the conference has officially run out of responsible decisions. ZerØ-Hour Party is ROOTCON’s post-con release valve: music, drinks, questionable dance moves, war stories, strange outfits, and one last room full of hackers refusing to call it a night. This is the final checkpoint of ROOTCON 20. Show up, cut loose, and help turn whatever happened during the conference into next year’s con lore. Access is FREE with your ROOTCON 20 Badge!

Hacker Jeopardy brings together teams willing to publicly demonstrate just how much random information they have accumulated over the years. Questions cover security, technology, internet history, hacker culture, movies, games, ROOTCON lore, and other facts that somehow remain stored in memory while important things are forgotten. Fast answers score points. Wrong answers become part of conference history.