https://www.epicturla.com/previous-works/hitb2020-voltron-sta Talks + Media Archived: 2026-10-25 02:06:15 UTC 2026 Planet Money: Can Computer Hackers Get Inside Your Mind? 2026-06-17podcastinterviewPlanet MoneyNPR Planet Money On the discovery of a twenty-year-old cyberweapon from the covert US–Israel–Iran nuclear conflict, built to hide on nuclear scientists' computers and quietly corrupt their calculations –the fast16 story told for a general audience. Ekoparty: The First Five Year Plan A.C. 2026-05-21keynoteEkopartyEkoparty, Miami The First Five Year Plan A.C.: Milestones for Security in the Age of AI A keynote on security work in the age of AI: a multiplier for practitioners with existing technical depth –compressing weeks of effort into hours– and a warning against organizations hastily shedding the expertise the multiplier depends on. Decipher: The fast16 Mystery, Stuxnet, and the History of Cyber Espionage 2026-05-04podcastinterviewDecipherDecipher (Duo Security) A discussion of fast16 –a cyberespionage platform sabotaging targets in Iran years before Stuxnet– and what its discovery does to the accepted history of cyber espionage. With Dennis Fisher. 2025 LABScon: Steps to an Ecology of Cyber 2025-10-18keynoteLABSconLABScon On LLMs, complexity, and the end of cybersecurity's experimental era — why the field needs an ecological turn. 2024 Ekoparty: Lado B 2024-11-13interviewEkopartyEkoparty, Buenos Aires A Lado B sit-down with Fede K at Ekoparty 2024. (In Spanish) Page 1 of 13 VB: Project 0xA11C 2024-10-02VirusBulletinVirus Bulletin, Dublin (also: REcon, Black Hat USA, Ekoparty) applied to RustDown, RustBucket, and Spica. Project 0xA11C across 2024 Dublin, Ekoparty Buenos Aires– incrementally improving the tooling throughout. REcon 2024, Montreal — June Black Hat USA 2024, Las Vegas — August Watch the Black Hat briefing Virus Bulletin 2024, Dublin — October Watch the VB2024 talk Ekoparty 2024, Buenos Aires — November Watch the Ekoparty talk LABScon: The Consolation of Threat Intel 2024-09-21keynoteLABSconLABScon might reinvigorate it. To The Point: 'Roided-Out Sitting Duck' (Parts 1 & 2) 2024-01-23podcastinterviewForcepointForcepoint — To The Point Cybersecurity and the state of threat intelligence. 2023 2023-11-20keynoteCyberThreatCyberThreat (NCSC + SANS), London On the ethics and practical intricacies of producing threat intelligence in hot conflicts. https://www.epicturla.com/previous-works/hitb2020-voltron-sta With Nicole Fishbein — a Rust reverse-engineering methodology and tooling in the spirit of AlphaGolang, Project 0xA11C (with Nicole Fishbein) developed across 2024 –REcon Montreal, Black Hat USA, VirusBulletin On professional disenchantment and the void of meaningful work in the threat intelligence industry — and what Two-part interview — Moonlight Maze research, becoming a hologram exhibit at the International Spy Museum, CyberThreat: The Intricacies of Wartime Cyber Threat Intelligence Page 2 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta VB: The Physics of Information Asymmetry 2023-10-06keynoteVirusBulletinVirus Bulletin, London What do you see when you remove the militaristic metaphors from our cybersecurity language? Information asymmetry as the structural feature of cyber conflict. LABScon: Sandman APT and the LuaJIT Toolkit 2023-09-20LABSconLABScon Unveiling the LuaJIT-based Sandman APT toolkit (LuaDream) targeting telcos. With Aleksandar Milenkoski. Dark Reading: News Desk at Black Hat USA 2023-08-16interviewDark ReadingDark Reading Live from the Black Hat floor: on the practical uses of large language models in security –democratizing reverse engineering, building niche tooling, and widening the talent pipeline. With Becky Bracken. Binarly: Advising on Firmware Security 2023-06-01interviewBinarlyBinarly A short spotlight as strategic advisor to Binarly –on the firmware visibility problem and the scale of vulnerabilities being found beneath the operating system. SURGe: Coffee Talk Live from RSA 2023-04-25podcastinterviewSplunk SURGeSplunk SURGe — RSA Conference A conversation among contributing authors of Bluenomicon, SURGe's compendium of stories and advice from security practitioners, recorded live at RSA 2023. With Mick Baccio and Jon DiMaggio. Berkeley: Building the Case for 'Cyber War Crimes' 2023-02-17panelUC BerkeleyUC Berkeley Human Rights Center Building the Case: Accountability for 'Cyber War Crimes' in Ukraine In conversation with Lindsay Freeman at Berkeley Law on the cyber dimension of the war in Ukraine and the effort to prosecute Russian cyberattacks as war crimes. 2022 Ekoparty: La Punta del Iceberg Page 3 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta 2022-11-02EkopartyEkoparty, Buenos Aires On the commercial incentives that keep threat intelligence blind to Latin America, and the region's most significant espionage groups –several with no published reporting to their name. (In Spanish) Security Conversations: Big-Game Malware Hunting and a Very Mysterious APT 2022-10-17podcastinterviewSecurity ConversationsSecurity Conversations Solo interview with Ryan Naraine on attribution, the nation-state threat landscape, and the Metador APT — the guest appearance that preceded the Three Buddy Problem co-host era. LABScon: The Mystery of Metador 2022-09-22LABSconLABScon Revealing Metador: a still-unattributed actor living for years inside telcos, ISPs, and universities across the Middle East and Africa. With Amitai Ben Shushan Ehrlich and Aleksandar Milenkoski. Black Hat: Modified Elephant 2022-08-10Black HatBlack Hat USA· with Tom Hegel Charged by an Elephant — An APT Fabricating Evidence to Throw You In Jail ModifiedElephant is responsible for targeted attacks on human rights activists, human rights defenders, academics, and lawyers across India with the objective of conducting espionage and plant incriminating digital evidence. We follow up on Arsenal Consulting’s excellent forensic investigation to describe the broader threat actor’s activities as early as 2012 “…This talk focuses on the activities of ModifiedElephant, a threat actor operating for at least a decade with ties to the commercial surveillance industry. More importantly, we’ll discuss how they’ve gone about incriminating activists who are locked up to this day despite forensic reports that show the evidence was planted. And if that’s not concerning enough, we’ll show how multiple regional threat actors were going after these same victims prior to their arrest…” “These guys are not going after terrorists. They’re going after human rights defenders and journalists. And it’s not right.” —worker at an email provider who shared evidence linking police to the ModifiedElephant hacking campaign Slides · SentinelLabs Blog · Full Paper · Washington Post · WIRED · Arsenal Consulting Black Hat: Real 'Cyber War' 2022-08-10Black HatBlack Hat USA, Las Vegas Page 4 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta Real 'Cyber War': Espionage, DDoS, Leaks, and Wipers in the Russian Invasion of Ukraine A survey of the espionage, DDoS, hack-and-leak, and wiper operations accompanying the Russian invasion of Ukraine, testing prevailing assumptions about 'cyber war' against its observed realities. With Tom Hegel. REcon: Beyond AlphaGolang 2022-06-04REconREcon, Montreal Taking AlphaGolang from IDB reconstruction to automated hunting: code similarity that sidesteps Go's boilerplate, YARA rules auto-generated from strings relinked to user functions, and developer-environment profiling to cluster malware by the hands that wrote it. 2021 CYBERWARCON: The Last Remaining Cover for Action 2021-11-16CYBERWARCONCYBERWARCON A discussion of hacktivism as cover for state operations –wiper attacks and hack-and-leaks staged behind grassroots personas by North Korean, Russian, Iranian, and mercenary actors since at least 2013– and the analytical tells that distinguish genuine lone actors from their imitators. 2020 HITB: Voltron STA 2020-11-18HITBHITB+ CyberWeek, Abu Dhabi (virtual) The curious case of 0xFancyFilter This talk covers the interesting case of ‘0xFancyFilter’, an amalgam between what could be referred to as Regin 1.5 and Equation Group’s MISTYVEAL. This rare piece of malware is the only documented instance of code overlap between the Regin and Equation Group frameworks and is used to illustrate the difference between stating a relationship between threat actors from public documents vs. being able to show that relationship based on technical findings. The rare –but not at all surprising– collaboration is dubbed the Voltron Supra Threat Actor (STA) as suggested early on by a friendly researcher. Page 5 of 13 in the Age of Mechanical Reproduction.” https://www.epicturla.com/previous-works/hitb2020-voltron-sta Watch the TalkDelivered at HITB+ CyberWeek under the conference billing “The Work of Cyber Technical Indicators In lieu of a proper write up, the following hashes should help replicate the work by any interested researchers. All samples discussed are available on VirusTotal :) 0xFancyFilter or Regin 1.5 (‘htmlfiltxx64.dll’ or ‘Microsoft\Internet Explorer\iesrch32.dat’) cd3ee807e349abae65d93e421176f302528b739e9e1d77a6ce4e57caeec91b4e Older 0xFF samples (‘httpfilt.dll’, ‘htmlfilt.dll’) 369145c6f366f25a4e8878ad1ffec73d680cdc2da4380b221d1d7cdf3a90c930 Page 6 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta ef35705696d78cc9f4de6adad2cbe5ed22fd50da0ce4180c1d47cf0536aebc87 df4bc387181ffaabe0be39e66ef5eb838ed638e0ae2b82e9a7daa83647e38bb1 Old EQGRP ‘nethdlr’ (MISTYVEAL) for comparison d8bab0b79bafec3a41db0dd4ae1703c2ab55de5af261e1881d62bde0d9033690 Regin’s Hopscotch with shared RC4 implementation d83428779b0c0ebfa08c6b50f34e0f1ae7812eeb9ed78b86610517d8208b6cb3 YARA A broad YARA rule focused on 0xFF features is available on GitHub HackerHunter: Olympic Destroyer 2020-11-12interviewhacker:HUNTERhacker:HUNTER documentary (Tomorrow Unlocked) A potential diplomatic disaster, a cunning nation-state attacker, wiper malware, and false flags meant to point the finger at the most-likely suspect… North Korea. 2019 VB: King of the Hill 2019-10-04VirusBulletinVirus Bulletin, London Nation-State Counter Intelligence for Victim Deconfliction A study of techniques mature cyber threat actors use to deconflict their targeting as witnessed in operations in-the- wild. REcon: Mining Disputed Territories 2019-06-30REconREcon, Montreal A study of how high-end malware families keep tabs on rival –and friendly– implants sharing a victim box, and what those in-the-wild attacker signatures reveal about operations we'd otherwise never see. CyberWire: A Fresh Look at GOSSIPGIRL and the Supra Threat Actors 2019-05-25podcastinterviewCyberWireThe CyberWire Research Saturday: A Fresh Look at GOSSIPGIRL and the Supra Threat Actors The GOSSIPGIRL research linking Equation, Flame, Duqu, and Flowershop as the supra threat actor (STA) umbrella supergroup behind Stuxnet. With Dave Bittner and Silas Cutler. Page 7 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta SAS: Who is GG? 2019-04-09SASSecurity Analyst Summit, Singapore· with Silas Cutler Tracking the Development of the Supra Threat Actor behind Stuxnet Delivered at the Security Analysts Summit 2019 in Singapore. SANS CTI Summit: Unsolved Mysteries 2019-01-21SANS CTI SummitSANS CTI Summit Unsolved Mysteries: Revisiting the APT Cold Case Files Promoting the school of ‘Cyber Paleontology’ by revisiting cold case APT investigations for new findings. Watch the Talk 2018 CYBERWARCON: Revisiting Known Perps 2018-11-28CYBERWARCONCYBERWARCON, Arlington VA Behavioral, criminal-profiling style characterization of threat actors instead of rigid institutional categorization. VB: Threat Intelligence Brokerage Revisited 2018-10-05VirusBulletinVirus Bulletin, Montreal Page 8 of 13 intelligence-brokerage thesis of the VB2015 paper. VB: Draw Me Like One of Your French APTs 2018-10-03VirusBulletinVirus Bulletin, Montreal Expanding Our Descriptive Palette for Cyber Threat Actors A highfalutin attempt to broaden our descriptive language for cyber threat actors and propose a behavioral profiling approach towards understanding their shifting compositions. Summercon: The New Hotness 2018-06-30SummerconSummercon / HushCon East The New Hotness — Hunting for Code Similarity at Scale Chronicle years. 2018-05-14podcastinterviewSecurity ConversationsSecurity Conversations A guest interview on what good threat intelligence practice actually looks like. With Ryan Naraine. https://www.epicturla.com/previous-works/hitb2020-voltron-sta A second, separate VB2018 session two days after 'Draw Me Like One of Your French APTs' — revisiting the Code-similarity-based malware hunting at scale, delivered at both Summercon and HushCon East during the Security Conversations: Threat Intel Quality and Nation-State Sophistication 2017 VB: Walking in Your Enemy's Shadow 2017-10-04VirusBulletinVirus Bulletin· with Costin Raiu When Fourth-Party Collection Becomes Attribution Hell A prescient discussion of complex dynamics that occur when APT’s hack APT’s to piggyback on their intelligence collection –referred to as ‘Fourth-Party Collection’. CyLab: Spies, CounterSpies, and the Missing Validators 2017-04-18CyLabCarnegie Mellon CyLab Distinguished Seminar An attempt to lobby the involvement of the broader academic community in Threat Intelligence and the role they could play in addressing our validation crisis. Page 9 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta Watch the Talk SAS: Penquin's Moonlit Maze 2017-04-03SASSecurity Analyst Summit· with David Hedges, Danny Moore, Costin Raiu, and Thomas Rid The joint Kaspersky/KCL investigation linking 1990s Moonlight Maze to Turla — digital archaeology on a sysadmin’s preserved attack server. Page 10 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta An Unlikely Discovery Thomas Rid’s contact with David Hedges, the administrator for ‘HRTEST’ –a company server compromised by state-sponsored hackers in the late ‘90s– enabled a modern day reconstruction of the infamous Moonlight Maze attacks against U.S. government, military, and university research networks. A Piece of History ‘HRTEST’ is now a permanent part of the International Spy Museum’s cyber espionage exhibit. Page 11 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta Visit HRTEST 2016 VB: Wave Your False Flags 2016-10-05VirusBulletinVirus Bulletin· with Brian Bartholomeow Deception Tactics Muddying Attribution in Targeted Attacks A timely discussion of the artifacts used to cobble together attribution and the ways in which threat actors are manipulating those indicators to throw us off their trail. The paper was written months before the ‘summer of Sofacy’ and provides an adequate conceptual framework to discuss realistic partial false flag operations. 2015 VB: Closing Keynote Guest Spot 2015-10-02keynoteVirusBulletinVirus Bulletin One Man’s Anti-Malware Researcher is… An early honor of my career was getting to share the stage as a guest to Costin Raiu’s closing keynote of VirusBulletin 2015. This is an open discussion of ‘spook’ vs. ‘anti-malware researchers’ where I got to play the part of the former for Costin’s argument. All credit to him for the excellent material. Page 12 of 13 https://www.epicturla.com/previous-works/hitb2020-voltron-sta Watch the Talk VB: The Ethics and Perils of APT Research 2015-09-30VirusBulletinVirus Bulletin An Unexpected Transition Into Intelligence Brokerage A discussion of the private sector’s transition from analyzing criminal malware to witnessing nation-state espionage operations –effectively embracing intelligence brokerage in all of its complexity. The organic development of a contentious nascent space resulted in misaligned incentives, half-baked production processes, and predictable validation crises playing out in front of our eyes to this day. Source: https://www.epicturla.com/previous-works/hitb2020-voltron-sta Page 13 of 13