Research connected to Argentina

• August 9, 2026 Talk Other Bug Bounty Village — DEF CON 2026 Ariel Walter García AR Heavy Metal and Hidden Secrets: A Five-Year Retrospective on DEF CON Challenge Coins

  Take a look behind the scenes at five years of custom DEF CON challenge coins from DEF CON 30 through DEF CON 34. This session walks through the entire lifecycle of these unique hardware puzzles, exploring the inspiration behind their designs, step-by-step solutions, and how the rise of AI is shifting the future of cryptographic challenges.

  ResearchersAriel Walter García AR

  Presented at Bug Bounty Village — DEF CON 2026

  View official session
• August 8, 2026 Talk Offensive Security DEF CON 34 Dan Borgogno AR·Javier Bernardo AR The Glass Perimeter: Systematic Bypasses in Biometric Frameworks and the Rise of Synthetic Identity

  Identity is the new perimeter, and biometrics are its supposed gatekeepers. But what happens when the gatekeepers are blind to the reality they consume? We spent more than 6 months deconstructing the biometric "Root of Trust" across every top-tier framework we could find, solutions relied upon by the world's largest banks and providers worth billions. The result: A 100% bypass rate. From high-fidelity physical spoofs to a first-of-its-kind Cross-PID buffer hijack against integrated anti-tamper SDKs, we prove that even multi-million dollar "fortresses" can be reduced to client-side theater.

  This talk is a technical journey through the guts of the mobile media pipeline, exposing how synthetic identities are manufactured at scale to bypass RASP, Kernel-level integrity, and AI models. When the "Master Key" is just another line of code an attacker can hook, the risk isn't just a bug, it's a systemic failure affecting millions of users. Customers are losing wealth, companies are buying illusions, and the glass perimeter is shattering.

  ResearchersDan Borgogno AR·Javier Bernardo AR

  Presented at DEF CON 34

  View official session
• August 8, 2026 Talk Malware & Reversing DEF CON 34 Federico Kirschbaum AR·Gaston Aznarez AR Root From Kilometers Away: Ubiquiti AirMax RCE

  You don't realize it until you see them; they're everywhere. From Wireless ISP links to the frontline of modern warfare. But nobody found anything? The devices behind those links are Ubiquiti AirMAX: critical infrastructure on a 17-year-old Linux kernel and a custom 802.11 extension built on "security by obscurity." So we took it apart. This talk covers our reverse engineering of the AirMAX protocol, AirOS, and the kernel modules behind this proprietary mode. It rides on 802.11 Information Elements that look encrypted, but we'll show why they aren't. What we found: two critical vulnerabilities (CVE-2026-21639, CVE-2026-21638) across airMAX AC, airMAX M, airFiber, and GigaBeam, over 50 devices. These are the bugs from the movies: Over-The-Air, unauthenticated, kernel-privilege RCE. No network access, just line of sight. They affect every AirMAX device ever shipped. We disclosed them through Ubiquiti's bug bounty program. The bugs were rated "Adjacent", except adjacent here means kilometers away. The same hardware can be turned around and pointed at the problem: we'll repurpose these devices as recon tools and release open-source software to locate AirMAX networks in the wild. This talk is about our journey, our tooling, and the state of security.

  ResearchersFederico Kirschbaum AR·Gaston Aznarez AR

  Presented at DEF CON 34

  View official session
• August 8, 2026 Talk Offensive Security AppSec Village — DEF CON 2026 Ignacio Navarro AR Every ride you take - Hacking a City's Public Transportation

  Let's talk about some critical infrastructure that millions of people use every day: Public transportation. In this talk, I'll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We'll walk through the technical exploitation path, the real-world impact and the lessons learned.

  ResearchersIgnacio Navarro AR

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 8, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Federico Pacheco AR·Diego Staino AR Learning Deception by Doing: Attacking and Defending

  Cyber deception is one of the most powerful and least understood defensive disciplines, most practitioners have read about honeypots, but few have ever deployed a breadcrumb, watched an attacker chase a fake credential, or felt the confusion deception causes from the attacker's side.

  This session shares the fundamentals of deception by doing and experiencing: what deceptive artifacts exist (honey-credentials, deceptive configs, honey-services, synthetic activity), where they belong in a real environment, what telemetry they generate, and how they change an adversary's behavior. Everything is practiced in an open-source, Docker-based playground that recreates a realistic multi-tier company, with an attacker toolkit on one side and a defender SIEM on the other, so attendees can safely play both roles.

  The 25-minute format is a guided demo; the 50-minute format is a hands-on lab.

  ResearchersFederico Pacheco AR·Diego Staino AR

  Presented at La Villa Hacker — DEF CON 2026

  Speaker page (Fede Pacheco) Speaker page (Diego Staino)
• August 8, 2026 Talk Malware & Reversing Malware Village — DEF CON 2026 Lisandro Ubiedo AR·Leandro Cuozzo AR How to destroy a country

  Some people just want to see the whole world burn. And some cyberwarfare units just want your systems to go pufff.

  Wipers are the cyber version of napalm, taking destruction from the kinetic to the cyberspace, and have been the most utilized weapons by cyberwars in the last decade. These wipers are design to destroy everything that they can get their hands on to: files, disks, backups, you name it. And they are purposefully designed this way by a dedicated group with their destabilizing a whole country in times of war.

  In this talk we are going to go through the history of wipers, since our discovery of Flame in 2012 to our latest research on a destructive wiper we named Lotus Wiper. We are going to go through the technical details as well as providing a panoramic view to the impact that these types of cyberweapons have on countries, companies and people around the globe.

  ResearchersLisandro Ubiedo AR·Leandro Cuozzo AR

  Presented at Malware Village — DEF CON 2026

  View official session
• August 7, 2026 Workshop AI Security La Villa Hacker — DEF CON 2026 Matias Armándola AR PentestGPT: The Art of Hacking with Words

  PentestGPT: The Art of Hacking with Words regresa a DEF CON, esta vez como un workshop completamente práctico. Luego de presentar el año pasado cómo los LLMs comenzaban a transformar la seguridad ofensiva, esta nueva edición lleva la experiencia al siguiente nivel: no solo será escuchar de este proyecto, lo podrás crear y ejecutar en tu entorno favorito.

  Durante 100 minutos, los participantes trabajarán directamente con PentestGPT y PentestGPT 2.0 para aprender cómo integrar IA en flujos reales de pentesting. A través de ejercicios guiados y escenarios ofensivos realistas, explorarán reconocimiento asistido por IA, generación de attack paths, análisis de hallazgos, prompt engineering ofensivo y validación técnica de resultados.

  Más allá de usar una herramienta, el workshop propone un cambio de mentalidad: entender cómo pasar de ejecutar tareas manuales a orquestar inteligencia ofensiva.

  ResearchersMatias Armándola AR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Workshop AppSec & Supply Chain Payment Village — DEF CON 2026 Dan Borgogno AR Introduction to the Wall of Wallets Challenge

  Wall of Wallets is a hands-on CTF challenge where the goal is simple: collect as many mock payment card details as you can from other participants. Using intentionally vulnerable services in a safe, isolated environment, you'll learn how common implementation mistakes expose sensitive data.

  Compete to top the Wall of Wallets leaderboard while discovering the real-world techniques attackers use and, importantly, how to defend against them.

  ResearchersDan Borgogno AR

  Presented at Payment Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Malware & Reversing Adversary Village — DEF CON 2026 Mauro Eldritch AR·Nelson Rafael Colón Merán DO Haetae: An Agent to Takedown North Korean C2 Servers

  In this talk, we introduce Haetae, an agent designed to profile, identify, and exploit C2 frameworks used by North Korean malware.

  Haetae supports both automated and interactive modes, allowing analysts to map and understand adversary infrastructure with different levels of control. It is built around a flexible rule-based system, enabling users to extend and refine detections as new patterns and frameworks emerge.

  In this first release, we will walk through real-world cases where Haetae was used to identify and take down infrastructure associated with Mach-O Man and POWerful Armadillo.

  We will also release a safe emulator of both malware C2 servers, allowing researchers and newcomers to experiment with Haetae in realistic, controlled environments without risk.

  This is a highly technical talk but can be enjoyed by both beginners and seasoned threat hunters.

  ResearchersMauro Eldritch AR·Nelson Rafael Colón Merán DO

  Presented at Adversary Village — DEF CON 2026

  View official session
• August 7, 2026 Workshop Malware & Reversing Red Team Village — DEF CON 2026 Mauro Eldritch AR·Nelson Rafael Colón Merán DO Haetae: An Agent to Takedown North Korean C2 Servers

  In this talk, we introduce Haetae, an agent designed to profile, identify, and exploit C2 frameworks used by North Korean malware.

  Haetae supports both automated and interactive modes, allowing analysts to map and understand adversary infrastructure with different levels of control. It is built around a flexible rule-based system, enabling users to extend and refine detections as new patterns and frameworks emerge.

  In this first release, we will walk through real-world cases where Haetae was used to identify and take down infrastructure associated with Mach-O Man and POWerful Armadillo.

  We will also release a safe emulator of both malware C2 servers, allowing researchers and newcomers to experiment with Haetae in realistic, controlled environments without risk.

  This is a highly technical talk but can be enjoyed by both beginners and seasoned threat hunters.

  ResearchersMauro Eldritch AR·Nelson Rafael Colón Merán DO

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Malware & Reversing Malware Village — DEF CON 2026 Mauro Eldritch AR North Korea's Zoo: Poaching for Gophers, Armadillos and RATs

  In this talk, a continuation of the North Korea's Zoo series, we take apart three new malware samples linked to North Korean operators: a fresh iteration of GoLangGhostRAT, POWerful Armadillo (a rework of Digit Stealer), and Mach-O Man, a new macOS malware kit. All of them were first-spotted and reversed by our team.

  We will focus on what actually matters: interesting bits of code, mistakes in their infrastructure, and how we were able to abuse their C2 to profile campaigns and mess with their operations.

  We'll also cover how these samples are being distributed, including some newer tricks we've been seeing in the wild.

  At several points, we ended up talking directly with the operators themselves. We'll be sharing those interactions here for the first time.

  This talk can be enjoyed by both beginners and seasoned threat hunters alike.

  ResearchersMauro Eldritch AR

  Presented at Malware Village — DEF CON 2026

  View official session
• August 6, 2026 Talk Malware & Reversing Black Hat USA 2026 Gaston Aznarez AR·Federico Kirschbaum AR·Dan Borgogno AR Root From Kilometers Away: Ubiquiti AirMax RCE

  You don't realize it until you see them; they are everywhere. From Wireless ISPs links, to the frontline of modern warfare. But no one found anything?

  Long-haul WiFi Links, specifically Ubiquiti AirMax. These devices are a critical part of networks running a 17 year old Linux kernel and a custom 802.11 extension that relies on the well-known "security by obscurity".

  This Briefing is about the reverse engineering of Ubiquiti's Airmax protocol, its AirOS, and its kernel modules in charge of this proprietary wireless mode. This is implemented on top of IEEE 802.11 Information Elements that look encrypted, but we will shed light and show you why they aren't.

  We found these devices were insecure, and we have evidence. Two critical vulnerabilities (CVE-2026-21639 and CVE-2026-21638) that affect seven device families, including airMAX AC, airMAX M, airFiber and GigaBeam platforms (over 50 currently-sold devices). These vulnerabilities are like the ones in movies, Over-The-Air unauthenticated remote code execution with kernel privileges, no network access, just line of sight. The bugs found affect all Airmax devices since inception.

  Vulnerabilities found by this research were responsibly reported through the official bug bounty program. They were rated in a lower tier, as "Adjacent", but this bug can be exploited kilometers away.

  Nonetheless, we will show how to use the same devices as recon tools and provide another open-source software to analyze and locate networks using this protocol.

  This Briefing is not only for showing vulnerabilities, but we also want you to know the state of security in these devices. We want to share our journey and share the tooling and discoveries we made along the way.

  Takeaway

  • Reconnaissance and network mapping: They will learn how to identify, enumerate, and map networks composed of these devices.
  • Remote exploitation of WISP infrastructure: Attendees will learn how we can exploit 2 new vulnerabilities at range against deployed wireless devices.
  • A roadmap for future research: We highlight device families we believe are still vulnerable and largely unexplored, giving attendees clear starting points to keep digging.

  ResearchersGaston Aznarez AR·Federico Kirschbaum AR·Dan Borgogno AR

  Presented at Black Hat USA 2026

  View official session
• August 5, 2026 Talk Offensive Security BSides Las Vegas 2026 Ignacio Navarro AR Every ride you take - Hacking a City's Public Transportation

  Let's talk about some critical infrastructure that millions of people use every day: Public transportation. In this talk, I'll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We'll walk through the technical exploitation path, the real-world impact and the lessons learned.

  ResearchersIgnacio Navarro AR

  Presented at BSides Las Vegas 2026

  View official session
• August 4, 2026 Talk Offensive Security BSides Las Vegas 2026 Ignacio Navarro AR Every ride you take - Hacking a City's Public Transportation (PART 2) - TOKEN: 13

  Let's talk about some critical infrastructure that millions of people use every day: Public transportation. In this talk, I'll present some findings that I discovered in the public transportation ecosystem of one of the largest cities in Argentina, impacting more than 1.5 million people daily. Reading code, chaining vulnerabilities, weak access controls, and flawed internal designs, I got full access to core mobility systems, from buses to taxis, including DVRs, transport cards, user data, real-time tracking and administrative panels. We'll walk through the technical exploitation path, the real-world impact and the lessons learned.

  ResearchersIgnacio Navarro AR

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Training Incident Response Black Hat USA 2026 Mariano E Quintana AR·Felipe Barbosa Alves BR Adversary Tradecraft Decoded: CTI from Zero to Hero

  Adversary Tradecraft Decoded: CTI from Zero to Hero is an immersive training program designed to bridge the gap between foundational cybersecurity knowledge and the practical, operational use of Cyber Threat Intelligence (CTI). This course provides a structured path for participants to transform raw adversary tradecraft into actionable intelligence products that support detection, response, and strategic defense.

  Starting from first principles, attendees will explore the intelligence lifecycle, types of CTI, and the role of cognitive biases in analysis. The course then advances into the practical decoding of adversary Tactics, Techniques, and Procedures (TTPs), mapping them against frameworks such as MITRE ATT&CK to create consistent and reliable intelligence outputs. Participants will learn to apply open standards (STIX, TAXII, OpenIOC), enrichment methods, and structured analytic techniques to normalize and contextualize threat data.

  The centerpiece of the training is a cloud-based lab environment that recreates realistic attack scenarios in a safe and controlled setting. Participants will investigate a simulated phishing and privilege escalation incident, reconstruct the cyber kill chain using the Diamond Model, extract indicators, and identify adversary behaviors. Through guided exercises, they will practice building competing hypotheses (ACH), mitigate the influence of analytical bias, and ultimately produce both technical and executive-level CTI reports.

  What makes this program unique is its dynamic and in-depth approach to understanding how intelligence is truly built, not just as a theoretical exercise, but as the foundation for making future decisions about whether and how to share it. Learners are pushed to challenge their own hypotheses and identify the biases inherent in the analytic process. While they work through a known case, the procedures and steps they follow can be directly applied to generating new, useful intelligence beyond the classroom.

  This hands-on, end-to-end process ensures that learners not only grasp the theory of CTI but also experience how to operationalize it in passive defense and threat hunting contexts. By simulating the work of real-world analysts, participants will leave with the ability to generate intelligence products that directly support security operations, reduce uncertainty in incident response, and inform decision-making at tactical, operational, and strategic levels.

  ResearchersMariano E Quintana AR·Felipe Barbosa Alves BR

  Presented at Black Hat USA 2026

  View official session
• August 3, 2026 Training Malware & Reversing Black Hat USA 2026 Verónica Valeros AR·Sebastián García AR Advanced Malware Traffic Analysis

  This intensive two-day training teaches you how to understand, detect, and investigate modern malware attacks through hands-on network traffic analysis. Instead of relying on tools or dashboards, you will learn to recognize malicious behavior by developing analytical skills, technical intuition, and a solid methodology drawn from real incidents.

  Across nine modules, you will analyze real-world captures, build timelines, and learn to separate normal from malicious activity. You will investigate ransomware behavior, botnet communications, DGAs, encrypted traffic, and custom protocols. You will also generate and analyze network logs and use machine learning.

  The training combines short theory blocks with guided labs, peer discussions, and exercises distilled from decades of experience in traffic analysis. By the end, you will have the confidence and methodology required to analyse traffic and make informed decisions during real incidents.

  ResearchersVerónica Valeros AR·Sebastián García AR

  Presented at Black Hat USA 2026

  View official session
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Diego Forni AR·Rocío Baggio AR Deeper into Trident: When AI Threat, Defense, and Routine Collide

  Demo: While most cyber ranges are focused on attacker agents and limited by rigid abstractions that fail to model the complexity of modern threats, Trident addresses this gap by integrating attacker, defender and benign agents into a Docker-based, hyper-realistic autonomous cyber range. In this session, we shift the spotlight entirely to the Blue Team, exploring how researchers and developers can evaluate novel defender agents and security tools within authentic enterprise networks.

  ResearchersDiego Forni AR·Rocío Baggio AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Gabriel Franco AR FARADAY - Automating your Continuous Scanning cycle with AI and Public Tools

  No abstract was found on the conference website.

  ResearchersGabriel Franco AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Javier Bernardo AR·Dan Borgogno AR The Glass Perimeter - Systematic Bypasses in Biometric Frameworks and the Rise of Synthetic Identity

  Biometrics are perceived as the definitive frontier of identity, but our research reveals a glass perimeter: transparent to the attacker and structurally fragile. Through environment instrumentation, we demonstrate how liveness detection collapses under attacks ranging from the physical lens to Kernel-level hijacking. This is not about isolated bugs, but the failure of a trust model that leaves business logic entirely exposed affecting millions of users and companies.

  ResearchersJavier Bernardo AR·Dan Borgogno AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk Other Ekoparty Miami 2026 Jorge Litvin AR The Cost of Not Knowing the Cost - How risk quantification changes the conversation — and the budget

  No abstract was found on the conference website.

  ResearchersJorge Litvin AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Juan Andrés Loncharich AR·Julián Ignacio Fernández AR Trident: Sharpening the Spear of Autonomous AI Defense

  While most cyber ranges are focused on attacker agents and limited by rigid abstractions that fail to model the complexity of modern threats, Trident addresses this gap by integrating attacker, defender and benign agents into a Docker-based, hyper-realistic autonomous cyber range. In this session, we shift the spotlight entirely to the Blue Team, exploring how researchers and developers can evaluate novel defender agents and security tools within authentic enterprise networks.

  ResearchersJuan Andrés Loncharich AR·Julián Ignacio Fernández AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Juan Urbano Stordeur AR Know Your Customer (KYC) - ¿Qué tan confiable es el reconocimiento facial en aplicaciones moviles?

  Esta charla busca evidenciar un problema que esta afectando a multiples empresas que implementan reconocimiento facial, dentro de su proceso diario. Ya sea para hacer validacion de integridad, pagos, 2FA, etc.

  Se mostrara la tecnica de Spoofing de camara, sumado a una componente de IA para poder modelar/crear input que luego sera utilizado mediante el spoofing de camara.

  ResearchersJuan Urbano Stordeur AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk Incident Response Ekoparty Miami 2026 Lisandro Ubiedo AR Wipers, the Cyberweapons of Mass Distraction

  Los borradores cibernéticos son la versión cibernética del napalm, llevando la destrucción del mundo físico al ciberespacio, y han sido las armas más utilizadas en las ciberguerras durante la última década. Estos borradores están diseñados para destruir todo lo que encuentran a su paso: archivos, discos, copias de seguridad, lo que sea. Y son diseñados deliberadamente de esta manera por un grupo especializado con el objetivo de desestabilizar un país entero en tiempos de guerra.

  En esta charla, repasaremos la historia de los borradores cibernéticos, desde nuestro descubrimiento de Flame en 2012 hasta nuestra investigación más reciente sobre un borrador cibernético destructivo al que llamamos Lotus Wiper. Analizaremos los detalles técnicos y ofreceremos una visión general del impacto que este tipo de armas cibernéticas tienen en países, empresas y personas de todo el mundo.

  ResearchersLisandro Ubiedo AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk Other Ekoparty Miami 2026 Lucas Lavarello AR Vibing w/Caution: A deep dive into a logic vulnerability introduced via incorrect operator use

  No abstract was found on the conference website.

  ResearchersLucas Lavarello AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Mariano Facundo Scigliano AR Harvest today decrypt tomorrow del mito a la realidad

  Harvest Now, Decrypt Later" (HNDL) no es un problema del futuro, es un ataque silencioso y masivo que está ocurriendo en este preciso instante. Agencias estatales y competidores corporativos están interceptando y almacenando exabytes de tráfico cifrado para descifrarlo una vez que la computación cuántica alcance su madurez (el llamado Q-Day).

  Esta charla magistral desmitifica la amenaza cuántica y explica con claridad cómo algoritmos matemáticos como el de Shor colapsarán los estándares actuales de seguridad (RSA, ECC).

  ResearchersMariano Facundo Scigliano AR

  Presented at Ekoparty Miami 2026

  View official schedule