{
	"id": "8fbbe195-6f00-42e9-9fa8-f93c3b73a0e4",
	"created_at": "2026-10-25T02:57:15.712714Z",
	"updated_at": "2026-10-25T03:06:11.468846Z",
	"deleted_at": null,
	"sha1_hash": "797ad5f26403c0674a4d26e0dde62ecd0bb69635",
	"title": "Talks + Media",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 940824,
	"plain_text": "https://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nTalks + Media\n\nArchived: 2026-10-25 02:06:15 UTC\n\n2026\n\nPlanet Money: Can Computer Hackers Get Inside Your Mind?\n\n2026-06-17podcastinterviewPlanet MoneyNPR Planet Money\n\nOn the discovery of a twenty-year-old cyberweapon from the covert US–Israel–Iran nuclear conflict, built to hide\n\non nuclear scientists' computers and quietly corrupt their calculations –the fast16 story told for a general audience.\n\nEkoparty: The First Five Year Plan A.C.\n\n2026-05-21keynoteEkopartyEkoparty, Miami\n\nThe First Five Year Plan A.C.: Milestones for Security in the Age of AI\n\nA keynote on security work in the age of AI: a multiplier for practitioners with existing technical depth\n\n–compressing weeks of effort into hours– and a warning against organizations hastily shedding the expertise the\n\nmultiplier depends on.\n\nDecipher: The fast16 Mystery, Stuxnet, and the History of Cyber Espionage\n\n2026-05-04podcastinterviewDecipherDecipher (Duo Security)\n\nA discussion of fast16 –a cyberespionage platform sabotaging targets in Iran years before Stuxnet– and what its\n\ndiscovery does to the accepted history of cyber espionage. With Dennis Fisher.\n\n2025\n\nLABScon: Steps to an Ecology of Cyber\n\n2025-10-18keynoteLABSconLABScon\n\nOn LLMs, complexity, and the end of cybersecurity's experimental era — why the field needs an ecological turn.\n\n2024\n\nEkoparty: Lado B\n\n2024-11-13interviewEkopartyEkoparty, Buenos Aires\n\nA Lado B sit-down with Fede K at Ekoparty 2024. (In Spanish)\n\nPage 1 of 13\n\nVB: Project 0xA11C\n\n2024-10-02VirusBulletinVirus Bulletin, Dublin (also: REcon, Black Hat USA, Ekoparty)\n\napplied to RustDown, RustBucket, and Spica.\n\nProject 0xA11C across 2024\n\nDublin, Ekoparty Buenos Aires– incrementally improving the tooling throughout.\n\nREcon 2024, Montreal — June\n\nBlack Hat USA 2024, Las Vegas — August\n\nWatch the Black Hat briefing\n\nVirus Bulletin 2024, Dublin — October\n\nWatch the VB2024 talk\n\nEkoparty 2024, Buenos Aires — November\n\nWatch the Ekoparty talk\n\nLABScon: The Consolation of Threat Intel\n\n2024-09-21keynoteLABSconLABScon\n\nmight reinvigorate it.\n\nTo The Point: 'Roided-Out Sitting Duck' (Parts 1 \u0026 2)\n\n2024-01-23podcastinterviewForcepointForcepoint — To The Point Cybersecurity\n\nand the state of threat intelligence.\n\n2023\n\n2023-11-20keynoteCyberThreatCyberThreat (NCSC + SANS), London\n\nOn the ethics and practical intricacies of producing threat intelligence in hot conflicts.\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nWith Nicole Fishbein — a Rust reverse-engineering methodology and tooling in the spirit of AlphaGolang,\n\nProject 0xA11C (with Nicole Fishbein) developed across 2024 –REcon Montreal, Black Hat USA, VirusBulletin\n\nOn professional disenchantment and the void of meaningful work in the threat intelligence industry — and what\n\nTwo-part interview — Moonlight Maze research, becoming a hologram exhibit at the International Spy Museum,\n\nCyberThreat: The Intricacies of Wartime Cyber Threat Intelligence\n\nPage 2 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nVB: The Physics of Information Asymmetry\n\n2023-10-06keynoteVirusBulletinVirus Bulletin, London\n\nWhat do you see when you remove the militaristic metaphors from our cybersecurity language? Information\n\nasymmetry as the structural feature of cyber conflict.\n\nLABScon: Sandman APT and the LuaJIT Toolkit\n\n2023-09-20LABSconLABScon\n\nUnveiling the LuaJIT-based Sandman APT toolkit (LuaDream) targeting telcos. With Aleksandar Milenkoski.\n\nDark Reading: News Desk at Black Hat USA\n\n2023-08-16interviewDark ReadingDark Reading\n\nLive from the Black Hat floor: on the practical uses of large language models in security –democratizing reverse\n\nengineering, building niche tooling, and widening the talent pipeline. With Becky Bracken.\n\nBinarly: Advising on Firmware Security\n\n2023-06-01interviewBinarlyBinarly\n\nA short spotlight as strategic advisor to Binarly –on the firmware visibility problem and the scale of vulnerabilities\n\nbeing found beneath the operating system.\n\nSURGe: Coffee Talk Live from RSA\n\n2023-04-25podcastinterviewSplunk SURGeSplunk SURGe — RSA Conference\n\nA conversation among contributing authors of Bluenomicon, SURGe's compendium of stories and advice from\n\nsecurity practitioners, recorded live at RSA 2023. With Mick Baccio and Jon DiMaggio.\n\nBerkeley: Building the Case for 'Cyber War Crimes'\n\n2023-02-17panelUC BerkeleyUC Berkeley Human Rights Center\n\nBuilding the Case: Accountability for 'Cyber War Crimes' in Ukraine\n\nIn conversation with Lindsay Freeman at Berkeley Law on the cyber dimension of the war in Ukraine and the\n\neffort to prosecute Russian cyberattacks as war crimes.\n\n2022\n\nEkoparty: La Punta del Iceberg\n\nPage 3 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\n2022-11-02EkopartyEkoparty, Buenos Aires\n\nOn the commercial incentives that keep threat intelligence blind to Latin America, and the region's most\n\nsignificant espionage groups –several with no published reporting to their name. (In Spanish)\n\nSecurity Conversations: Big-Game Malware Hunting and a Very Mysterious APT\n\n2022-10-17podcastinterviewSecurity ConversationsSecurity Conversations\n\nSolo interview with Ryan Naraine on attribution, the nation-state threat landscape, and the Metador APT — the\n\nguest appearance that preceded the Three Buddy Problem co-host era.\n\nLABScon: The Mystery of Metador\n\n2022-09-22LABSconLABScon\n\nRevealing Metador: a still-unattributed actor living for years inside telcos, ISPs, and universities across the Middle\n\nEast and Africa. With Amitai Ben Shushan Ehrlich and Aleksandar Milenkoski.\n\nBlack Hat: Modified Elephant\n\n2022-08-10Black HatBlack Hat USA· with Tom Hegel\n\nCharged by an Elephant — An APT Fabricating Evidence to Throw You In Jail\n\nModifiedElephant is responsible for targeted attacks on human rights activists, human rights defenders,\n\nacademics, and lawyers across India with the objective of conducting espionage and plant incriminating digital\n\nevidence. We follow up on Arsenal Consulting’s excellent forensic investigation to describe the broader threat\n\nactor’s activities as early as 2012\n\n“…This talk focuses on the activities of ModifiedElephant, a threat actor operating for at least a decade with ties\n\nto the commercial surveillance industry. More importantly, we’ll discuss how they’ve gone about incriminating\n\nactivists who are locked up to this day despite forensic reports that show the evidence was planted. And if that’s\n\nnot concerning enough, we’ll show how multiple regional threat actors were going after these same victims prior\n\nto their arrest…”\n\n“These guys are not going after terrorists. They’re going after human rights defenders and journalists.\n\nAnd it’s not right.”\n\n—worker at an email provider who shared evidence linking police to the ModifiedElephant hacking\n\ncampaign\n\nSlides · SentinelLabs Blog · Full Paper · Washington Post · WIRED · Arsenal Consulting\n\nBlack Hat: Real 'Cyber War'\n\n2022-08-10Black HatBlack Hat USA, Las Vegas\n\nPage 4 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nReal 'Cyber War': Espionage, DDoS, Leaks, and Wipers in the Russian Invasion of Ukraine\n\nA survey of the espionage, DDoS, hack-and-leak, and wiper operations accompanying the Russian invasion of\n\nUkraine, testing prevailing assumptions about 'cyber war' against its observed realities. With Tom Hegel.\n\nREcon: Beyond AlphaGolang\n\n2022-06-04REconREcon, Montreal\n\nTaking AlphaGolang from IDB reconstruction to automated hunting: code similarity that sidesteps Go's\n\nboilerplate, YARA rules auto-generated from strings relinked to user functions, and developer-environment\n\nprofiling to cluster malware by the hands that wrote it.\n\n2021\n\nCYBERWARCON: The Last Remaining Cover for Action\n\n2021-11-16CYBERWARCONCYBERWARCON\n\nA discussion of hacktivism as cover for state operations –wiper attacks and hack-and-leaks staged behind\n\ngrassroots personas by North Korean, Russian, Iranian, and mercenary actors since at least 2013– and the\n\nanalytical tells that distinguish genuine lone actors from their imitators.\n\n2020\n\nHITB: Voltron STA\n\n2020-11-18HITBHITB+ CyberWeek, Abu Dhabi (virtual)\n\nThe curious case of 0xFancyFilter\n\nThis talk covers the interesting case of ‘0xFancyFilter’, an amalgam between what could be referred to as Regin\n\n1.5 and Equation Group’s MISTYVEAL. This rare piece of malware is the only documented instance of code\n\noverlap between the Regin and Equation Group frameworks and is used to illustrate the difference between stating\n\na relationship between threat actors from public documents vs. being able to show that relationship based on\n\ntechnical findings. The rare –but not at all surprising– collaboration is dubbed the Voltron Supra Threat Actor\n\n(STA) as suggested early on by a friendly researcher.\n\nPage 5 of 13\n\nin the Age of Mechanical Reproduction.”\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nWatch the TalkDelivered at HITB+ CyberWeek under the conference billing “The Work of Cyber\n\nTechnical Indicators\n\nIn lieu of a proper write up, the following hashes should help replicate the work by any interested researchers. All\n\nsamples discussed are available on VirusTotal :)\n\n0xFancyFilter or Regin 1.5 (‘htmlfiltxx64.dll’ or ‘Microsoft\\Internet Explorer\\iesrch32.dat’)\n\ncd3ee807e349abae65d93e421176f302528b739e9e1d77a6ce4e57caeec91b4e\n\nOlder 0xFF samples (‘httpfilt.dll’, ‘htmlfilt.dll’)\n\n369145c6f366f25a4e8878ad1ffec73d680cdc2da4380b221d1d7cdf3a90c930\n\nPage 6 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nef35705696d78cc9f4de6adad2cbe5ed22fd50da0ce4180c1d47cf0536aebc87\n\ndf4bc387181ffaabe0be39e66ef5eb838ed638e0ae2b82e9a7daa83647e38bb1\n\nOld EQGRP ‘nethdlr’ (MISTYVEAL) for comparison\n\nd8bab0b79bafec3a41db0dd4ae1703c2ab55de5af261e1881d62bde0d9033690\n\nRegin’s Hopscotch with shared RC4 implementation\n\nd83428779b0c0ebfa08c6b50f34e0f1ae7812eeb9ed78b86610517d8208b6cb3\n\nYARA\n\nA broad YARA rule focused on 0xFF features is available on GitHub\n\nHackerHunter: Olympic Destroyer\n\n2020-11-12interviewhacker:HUNTERhacker:HUNTER documentary (Tomorrow Unlocked)\n\nA potential diplomatic disaster, a cunning nation-state attacker, wiper malware, and false flags meant to point the\n\nfinger at the most-likely suspect… North Korea.\n\n2019\n\nVB: King of the Hill\n\n2019-10-04VirusBulletinVirus Bulletin, London\n\nNation-State Counter Intelligence for Victim Deconfliction\n\nA study of techniques mature cyber threat actors use to deconflict their targeting as witnessed in operations in-the-\n\nwild.\n\nREcon: Mining Disputed Territories\n\n2019-06-30REconREcon, Montreal\n\nA study of how high-end malware families keep tabs on rival –and friendly– implants sharing a victim box, and\n\nwhat those in-the-wild attacker signatures reveal about operations we'd otherwise never see.\n\nCyberWire: A Fresh Look at GOSSIPGIRL and the Supra Threat Actors\n\n2019-05-25podcastinterviewCyberWireThe CyberWire\n\nResearch Saturday: A Fresh Look at GOSSIPGIRL and the Supra Threat Actors\n\nThe GOSSIPGIRL research linking Equation, Flame, Duqu, and Flowershop as the supra threat actor (STA)\n\numbrella supergroup behind Stuxnet. With Dave Bittner and Silas Cutler.\n\nPage 7 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nSAS: Who is GG?\n\n2019-04-09SASSecurity Analyst Summit, Singapore· with Silas Cutler\n\nTracking the Development of the Supra Threat Actor behind Stuxnet\n\nDelivered at the Security Analysts Summit 2019 in Singapore.\n\nSANS CTI Summit: Unsolved Mysteries\n\n2019-01-21SANS CTI SummitSANS CTI Summit\n\nUnsolved Mysteries: Revisiting the APT Cold Case Files\n\nPromoting the school of ‘Cyber Paleontology’ by revisiting cold case APT investigations for new findings.\n\nWatch the Talk\n\n2018\n\nCYBERWARCON: Revisiting Known Perps\n\n2018-11-28CYBERWARCONCYBERWARCON, Arlington VA\n\nBehavioral, criminal-profiling style characterization of threat actors instead of rigid institutional categorization.\n\nVB: Threat Intelligence Brokerage Revisited\n\n2018-10-05VirusBulletinVirus Bulletin, Montreal\n\nPage 8 of 13\n\nintelligence-brokerage thesis of the VB2015 paper.\n\nVB: Draw Me Like One of Your French APTs\n\n2018-10-03VirusBulletinVirus Bulletin, Montreal\n\nExpanding Our Descriptive Palette for Cyber Threat Actors\n\nA highfalutin attempt to broaden our descriptive language for cyber threat actors and propose a behavioral\n\nprofiling approach towards understanding their shifting compositions.\n\nSummercon: The New Hotness\n\n2018-06-30SummerconSummercon / HushCon East\n\nThe New Hotness — Hunting for Code Similarity at Scale\n\nChronicle years.\n\n2018-05-14podcastinterviewSecurity ConversationsSecurity Conversations\n\nA guest interview on what good threat intelligence practice actually looks like. With Ryan Naraine.\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nA second, separate VB2018 session two days after 'Draw Me Like One of Your French APTs' — revisiting the\n\nCode-similarity-based malware hunting at scale, delivered at both Summercon and HushCon East during the\n\nSecurity Conversations: Threat Intel Quality and Nation-State Sophistication\n\n2017\n\nVB: Walking in Your Enemy's Shadow\n\n2017-10-04VirusBulletinVirus Bulletin· with Costin Raiu\n\nWhen Fourth-Party Collection Becomes Attribution Hell\n\nA prescient discussion of complex dynamics that occur when APT’s hack APT’s to piggyback on their intelligence\n\ncollection –referred to as ‘Fourth-Party Collection’.\n\nCyLab: Spies, CounterSpies, and the Missing Validators\n\n2017-04-18CyLabCarnegie Mellon CyLab Distinguished Seminar\n\nAn attempt to lobby the involvement of the broader academic community in Threat Intelligence and the role they\n\ncould play in addressing our validation crisis.\n\nPage 9 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nWatch the Talk\n\nSAS: Penquin's Moonlit Maze\n\n2017-04-03SASSecurity Analyst Summit· with David Hedges, Danny Moore, Costin Raiu, and Thomas Rid\n\nThe joint Kaspersky/KCL investigation linking 1990s Moonlight Maze to Turla — digital archaeology on a\n\nsysadmin’s preserved attack server.\n\nPage 10 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nAn Unlikely Discovery\n\nThomas Rid’s contact with David Hedges, the administrator for ‘HRTEST’ –a company server compromised by\n\nstate-sponsored hackers in the late ‘90s– enabled a modern day reconstruction of the infamous Moonlight Maze\n\nattacks against U.S. government, military, and university research networks.\n\nA Piece of History\n\n‘HRTEST’ is now a permanent part of the International Spy Museum’s cyber espionage exhibit.\n\nPage 11 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nVisit HRTEST\n\n2016\n\nVB: Wave Your False Flags\n\n2016-10-05VirusBulletinVirus Bulletin· with Brian Bartholomeow\n\nDeception Tactics Muddying Attribution in Targeted Attacks\n\nA timely discussion of the artifacts used to cobble together attribution and the ways in which threat actors are\n\nmanipulating those indicators to throw us off their trail. The paper was written months before the ‘summer of\n\nSofacy’ and provides an adequate conceptual framework to discuss realistic partial false flag operations.\n\n2015\n\nVB: Closing Keynote Guest Spot\n\n2015-10-02keynoteVirusBulletinVirus Bulletin\n\nOne Man’s Anti-Malware Researcher is…\n\nAn early honor of my career was getting to share the stage as a guest to Costin Raiu’s closing keynote of\n\nVirusBulletin 2015. This is an open discussion of ‘spook’ vs. ‘anti-malware researchers’ where I got to play the\n\npart of the former for Costin’s argument. All credit to him for the excellent material.\n\nPage 12 of 13\n\nhttps://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nWatch the Talk\n\nVB: The Ethics and Perils of APT Research\n\n2015-09-30VirusBulletinVirus Bulletin\n\nAn Unexpected Transition Into Intelligence Brokerage\n\nA discussion of the private sector’s transition from analyzing criminal malware to witnessing nation-state\n\nespionage operations –effectively embracing intelligence brokerage in all of its complexity. The organic\n\ndevelopment of a contentious nascent space resulted in misaligned incentives, half-baked production processes,\n\nand predictable validation crises playing out in front of our eyes to this day.\n\nSource: https://www.epicturla.com/previous-works/hitb2020-voltron-sta\n\nPage 13 of 13",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.epicturla.com/previous-works/hitb2020-voltron-sta"
	],
	"report_names": [
		"hitb2020-voltron-sta"
	],
	"threat_actors": [],
	"ts_created_at": 1792897035,
	"ts_updated_at": 1792897571,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/797ad5f26403c0674a4d26e0dde62ecd0bb69635.pdf",
		"text": "https://archive.orkl.eu/797ad5f26403c0674a4d26e0dde62ecd0bb69635.txt",
		"img": "https://archive.orkl.eu/797ad5f26403c0674a4d26e0dde62ecd0bb69635.jpg"
	}
}