Research connected to Brazil

• August 9, 2026 Talk Offensive Security Red Team Village — DEF CON 2026 Murilo Caixeta BR Living Off WebView2: Turning Microsoft's Browser into a Red Team Asset

  Modern Windows applications are quietly shipping with a built-in Chromium-based browser, WebView2, running inside trusted, signed processes such as Microsoft Teams, Outlook, and other enterprise software.

  This talk shows how that design choice creates a powerful and largely unmonitored attack surface.

  I demonstrate how this model can be abused in offensive operations, turning WebView2 into a vector for persistence, code execution, and enterprise account impersonation.

  I show how feature flags and environment variables can be leveraged to manipulate the WebView2 runtime, enabling techniques such as DLL sideloading within legitimate applications. This allows arbitrary code execution inside trusted processes, supporting stealthy living-off-the-land persistence.

  Building on this, I present methods to intercept and proxy HTTP/HTTPS traffic generated by WebView2-based applications. This enables the extraction of session tokens, cookies, and other sensitive artifacts, leading to realistic account takeover and impersonation scenarios, including access to platforms such as Office 365.

  In addition to the offensive techniques, I provide a detailed analysis of the Indicators of Compromise (IOCs) generated throughout these attack chains. I highlight detection opportunities, discuss current visibility gaps in EDR solutions, and propose practical approaches for identifying and responding to this type of activity in real-world environments.

  ResearchersMurilo Caixeta BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 9, 2026 Talk AI Security La Villa Hacker — DEF CON 2026 Alcyon Junior BR Bait the Bot: Hacking Back Autonomous AI Vulnerability Scanners

  Autonomous, LLM-powered vulnerability scanners now crawl the web at scale, and every one of them shares the same structural weakness: it reads the content you control. This talk flips the engagement. Instead of just blocking the bot, your site detects that an AI agent is scanning it, fingerprints the model behind it, and fires back a hidden, tailored prompt injection that derails, poisons, or neutralizes the attacking agent, with no traditional exploit involved.

  We build on recent academic work on prompt-injection "hack back," push it into the reconnaissance-and-scanning threat model with live demos, walk through an escalating cat-and-mouse between attacker and defender, and take an honest look at where active defense crosses the legal line. Red teamers and blue teamers alike will leave with something they can responsibly test the same week.

  ResearchersAlcyon Junior BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 9, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Fernando Mengali BR·Thiago Cunha da Silva BR From Buffer Overflow to Blackout: Chaining Attacks Against Industrial Systems

  This presentation takes a practical, demo-driven approach to exploitation, demonstrating how a buffer overflow vulnerability can still serve as an entry point to compromise modern industrial infrastructures. The session is approximately 90% hands-on and 10% theoretical.

  The talk walks through the full attack chain, starting from initial exploitation and progressing to the development and execution of multistage shellcode. This shellcode establishes communication with a remote Command and Control (C2) server, retrieves an additional payload, and executes it directly in memory, bypassing traditional detection mechanisms.

  Once the environment is compromised, the session demonstrates how an attacker can gain full remote control, enabling command execution, lateral movement, and exfiltration of sensitive data, including critical assets such as licenses and proprietary industrial information.

  The talk also includes interaction with real-world devices such as RTUs (Remote Terminal Units), showing how malicious actions can directly impact industrial operations. In critical scenarios, this can lead to disruptions in essential services, including failures in energy systems and potential blackouts.

  The content is based on real-world pentesting experience conducted in an energy sector company in Brazil, providing a practical and applied perspective on risks in ICS/SCADA environments.

  The goal is to demonstrate how modern attacks combine vulnerabilities with advanced techniques, reinforcing the need for robust security strategies to protect critical infrastructure.

  ResearchersFernando Mengali BR·Thiago Cunha da Silva BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 9, 2026 Talk AppSec & Supply Chain AppSec Village — DEF CON 2026 Filipi Pires BR From commit to compromise: securing the full pipeline with AI-assisted remediation

  Most vulnerabilities aren't found because teams lack tools they persist because the cost of fixing them is too high. A finding without a concrete, context-aware fix is just noise developers learn to ignore. This talk walks through three real-world attack scenarios a secret leaked into git history, a compromised dependency in a supply chain attack, and an injection vulnerability introduced in a PR and shows how each is detected, mapped to OWASP Top 10:2025, and automatically remediated using AI running entirely on local infrastructure. No source code leaves the machine. The AI receives the vulnerable code block, CWE identifier, CVSS score, and OWASP category and returns a fix that is specific, correct, and ready to apply. Attendees leave with a working open-source tool and a new mental model for what AppSec remediation can look like.

  ResearchersFilipi Pires BR

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 8, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Fernando Mengali BR De la Explotación de Buffer Overflows al C2 Industrial: Infectando y Controlando RTUs con Malware

  En esta charla práctica y directa al punto, se demostrará cómo una vulnerabilidad de buffer overflow puede ser explotada para comprometer entornos SCADA, evolucionando desde la ejecución de shellcode multietapa hasta el establecimiento de canales de comunicación C2 y el control remoto de sistemas industriales críticos. A través de demostraciones técnicas, se analizará cómo una vulnerabilidad aparentemente aislada puede convertirse en una cadena de ataque capaz de afectar procesos industriales, provocar interrupciones operativas e incluso derivar en escenarios de blackout.

  ResearchersFernando Mengali BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Talk AppSec & Supply Chain La Villa Hacker — DEF CON 2026 Davidson Mizael BR Self Hosting Nightmare - Exploiting AI models for supply chain attacks

  In this presentation I'll go through the process of how you could possibly exploit this vulnerability in one of thousands servers exposed to the internet running the top one tool in the world for self hosting AI models. The process I'll demonstrate in this presentation involves exploring vulnerable by default decisions to achieve total control of this model serving tool, and the vulnerability research I have done on top of this tool that led me to find 7 0day vulnerabilities that allows anyone to achieve the following results:

  • Free token usage
  • Cause unavailability in the servers
  • Steal top of the market secret models
  • Cause chaos within dependent services with a model defacement
  • Craft a supply attack

  ResearchersDavidson Mizael BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Talk AppSec & Supply Chain La Villa Hacker — DEF CON 2026 Natan Morette BR The CVE-Hunters Project: From Noobs to Researchers

  The presentation explores how the Brazilian CVE-Hunters Project transformed beginners with zero published research into recognized vulnerability researchers contributing to global cybersecurity. By breaking down the myth that CVEs require genius-level exploits or zero-days, the talk reveals a structured, repeatable methodology that turns curiosity into impact.

  Key topics include how vulnerability research can be systematized, how responsible disclosure works behind the scenes, and how publishing a first CVE can change technical credibility, career trajectory, and confidence.

  The speaker emphasizes this goes "beyond a technical presentation" to provide "a blueprint for moving from learning hacking to becoming a researcher" and contributing meaningfully to the security ecosystem, framing the first CVE as about "responsibility, growth, and raising the bar for global security."

  ResearchersNatan Morette BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Filipi Pires BR DPAPI Is Not a Boundary: A Full Infostealer Kill Chain Operators Can Replicate

  Complete infostealer kill chain hands-on, executed against Windows 11 21H2 on default UAC using only open-source tooling. No zero-days, no commercial C2. Participants run every command live: HTA delivery, Meterpreter in-memory session, Chrome and Edge credential extraction via DPAPI-locked SQLite, keylogging in explorer.exe memory, UAC bypass via fodhelper, SYSTEM via Named Pipe Impersonation, and LSASS dump via Kiwi. The DPAPI_SYSTEM key recovered from LSA secrets decrypts the browser credentials captured earlier, closing the loop.

  OUTLINE

  • Stage 1: generate HTA payload, deliver via Python HTTP server, open Meterpreter session
  • Stage 2: extract Chrome and Edge credentials via post module, inspect DPAPI-encrypted loot
  • Stage 3: migrate to explorer.exe, start keyscan, capture live keystrokes
  • Stage 4: UAC bypass via fodhelper registry hijack, elevate to SYSTEM via Named Pipe Impersonation
  • Stage 5: load Kiwi, dump NTLM hashes, SAM, LSA secrets, extract DPAPI_SYSTEM key, decrypt browser loot
  • Detection debrief: Sysmon Event ID 1 process tree and PowerShell Script Block log review per stage

  TAKEAWAYS

  1. A complete credential theft playbook from HTA delivery to LSASS dump, validated against Windows 11 21H2 with Chrome 147 and Edge 147 on default UAC, ready to adapt for engagements.
  2. The DPAPI close-loop: how DPAPI_SYSTEM from LSA secrets decrypts browser credentials collected earlier, giving operators a concrete credential pivot from a single user-context session.
  3. A detection gap map calibrated against real Sysmon telemetry showing which events fire on default Windows 11 and which require EDR behavioral rules most organizations do not have deployed.

  ResearchersFilipi Pires BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 8, 2026 Workshop Offensive Security Adversary Village — DEF CON 2026 Filipi Pires BR Infostealer: Replicating Commodity Threat Actor Credential Theft TTPs and Validating Detection Gaps

  Commodity infostealers account for a significant share of initial access in enterprise breaches. Their TTPs are documented, their tooling is public, and most detection stacks still miss them. This workshop emulates the full infostealer playbook against a live target and measures exactly where the gaps are.

  Attendees execute an eight-stage adversary emulation scenario replicating documented commodity threat actor TTPs: HTA phishing delivery, in-memory C2 via Meterpreter, browser credential theft from Chrome and Edge using DPAPI and the SQLite Login Data file, in-memory keylogging via process migration to explorer.exe, UAC bypass using the fodhelper registry hijack documented across multiple threat actor profiles, and LSASS credential dumping via Kiwi/Mimikatz recovering NTLM hashes, SAM contents, and the DPAPI_SYSTEM master key. Every technique is drawn from documented threat actor behavior and mapped to MITRE ATT&CK before execution begins.

  The second half of the workshop shifts to validation. Attendees enable Sysmon64 telemetry and replay the emulation, stage by stage, identifying which techniques generated detectable events and which did not. Each gap maps to a concrete control recommendation. The keylogging stage writes nothing to disk. The Meterpreter session exists only in memory. The DPAPI_SYSTEM extraction is not anomalous to most SIEMs by default. Attendees document all three as validated findings, not assumptions.

  Key Takeaways

  1. Adversary emulation with real TTPs produces validated detection gaps, not theoretical ones. Running the actual technique against your stack tells you whether the control works. Running it in this workshop tells you before an attacker does.

  2. In-memory execution breaks file-based detection entirely. Meterpreter leaves no binary on disk. The only detection path is behavioral: process injection signals, memory scanning, or network correlation between a user-context process and an external C2 session.

  3. DPAPI_SYSTEM recovery after LSASS access retroactively compromises all protected data on the machine. Most SIEMs do not alert on this extraction by default. Attendees leave with the specific Event IDs and Sysmon rule configuration that catch it.

  ResearchersFilipi Pires BR

  Presented at Adversary Village — DEF CON 2026

  View official session
• August 8, 2026 Talk Malware & Reversing La Villa Hacker — DEF CON 2026 Filipi Pires BR From Live Malware to Red Team Tradecraft: Process Hollowing in msbuild.exe

  The best hiding place is often a binary Microsoft already signed. This talk presents a complete red team operation reconstructed from a real multi-stage JScript dropper captured in April 2026 targeting Energy, Government, and Aerospace organizations. Using custom tooling and malware analysis, we transformed the adversary's workflow into a repeatable offensive playbook focused on trusted binary abuse, fileless execution, and stealthy process injection.

  The session demonstrates how attackers delivered a .NET payload through steganographic C2 hosted on trusted paste services, loaded assemblies directly in memory with Reflection.Assembly::Load(), and performed Process Hollowing into msbuild.exe using native Windows APIs including ZwUnmapViewOfSection, VirtualAllocEx, and SetThreadContext.

  We also explore operational evasion techniques such as WMI hidden process spawning, obfuscated Base64 transformations, and Sysmon telemetry analysis from the perspective of a red team operator. Every technique shown was extracted from a live adversary sample and operationalized for realistic adversary emulation.

  ResearchersFilipi Pires BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Christiane Borges Santos BR O Lado Sombrio das Coisas: Transformando Dispositivos DIY em Vetores de Ataque

  O objetivo principal desta palestra é demonstrar como a democratização do hardware e da filosofia Do It Yourself (DIY) aceleraram a prototipagem rápida, mas na pressa para ver o projeto "funcionar" muitas vezes ignoram os padrões mínimos de segurança. A idéia é provocar a audiência a adotar a filosofia "Secure by Making", integrando o hardening e a análise de superfícies de ataque desde a primeira solda e linha de código do protótipo.

  ResearchersChristiane Borges Santos BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Talk Malware & Reversing Malware Village — DEF CON 2026 Rafael Felix BR Lyra: An LLVM IR Obfuscator for Rust

  Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust's unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach.

  This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal "cargo build" via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline, string encryption, basic-block shuffling, indirect-branch obfuscation, recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project's source code, one flag on the command line.

  We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell's undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja.

  We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build.

  Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day.

  ResearchersRafael Felix BR

  Presented at Malware Village — DEF CON 2026

  View official session
• August 7, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Rafael Felix BR Shapeshifting C2: Applying DAITA Traffic Shaping to Defeat DPI and DLP Detection

  ML-based DPI and DLP solutions have made signature evasion insufficient. Modern enterprise detection analyzes packet size distributions, inter-packet timing, and burst patterns to fingerprint C2 traffic regardless of how well headers and TLS certificates are spoofed.

  This talk demonstrates how three techniques from the VPN privacy research space - originally developed to defeat traffic analysis against Tor and Mullvad, can be adapted for offensive C2 operations:

  1. Constant-size packet morphing: forcing all frames to a fixed MTU-aligned size removes the packet-size fingerprint that ML classifiers depend on;

  2. Cover traffic injection: dummy packets sent at Poisson-distributed or adaptive intervals make real beacon timing statistically invisible;

  3. Probabilistic pattern distortion: Maybenot-inspired state machines inject cover bursts alongside real packets, destroying recognizable C2 sequences;

  We then will see how layering these techniques with application-layer malleable profiles (traffic impersonating Microsoft Graph, Slack, or Okta) and bonus: indirect transports like cloud storage dead-drops (S3, OneDrive) creates C2 channels that defeat detection at every layer simultaneously - behavioral, flow, and application.

  Attendees leave with a concrete mental model for building evasion stacks that go beyond header manipulation.

  ResearchersRafael Felix BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 7, 2026 Workshop AppSec & Supply Chain Red Team Village — DEF CON 2026 Natan Morette BR Quality over Quantity: How to Publish CVEs that Actually Matter

  This hands-on tactic focuses on making CVE discovery and publication practical, accessible, and repeatable. Instead of treating vulnerability research as an individual or highly specialized skill, this session introduces a structured workflow that attendees can immediately apply.

  Attendees will follow a step-by-step approach to:

  • Explore a scoped attack surface
  • Apply a curated vulnerability pattern checklist
  • Identify and validate a potential vulnerability
  • Structure the finding in a simplified CVE-style format

  All materials are prepared in advance to ensure the activity can be completed within 30–60 minutes and repeated across multiple waves of participants.

  This tactic emphasizes doing over theory, helping attendees leave not just with knowledge, but with a clear, reusable method for identifying and documenting vulnerabilities and a better understanding of how CVE publishing can be integrated into team workflows.

  ResearchersNatan Morette BR

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 7, 2026 Arsenal AppSec & Supply Chain AppSec Village — DEF CON 2026 Filipi Pires BR Drogonsec: SAST + SCA + Secrets + IaC in one open-source scanner

  Drogonsec is an open-source, high-performance security scanner built for developers and CI/CD pipelines. In a single run, it combines four analysis engines: SAST for 20+ languages, SCA for dependency CVEs, secret detection with 50+ patterns (AWS, GCP, GitHub, JWTs, SSH keys), and IaC misconfiguration analysis for Terraform and Kubernetes, all mapped to OWASP Top 10:2025 and CWE, with CVSS 3.1 scoring and SARIF output for GitHub and Azure DevOps integration.

  This Arsenal session will demo Drogonsec scanning real-world repositories live, showing findings across all four engines, explaining rule design decisions, and showcasing how teams can extend it with custom YAML rules. Attendees leave with a running tool they can drop into their pipelines the same day.

  ResearchersFilipi Pires BR

  Presented at AppSec Village — DEF CON 2026

  View official session
• August 4, 2026 Talk Malware & Reversing BSides Las Vegas 2026 Rafael Felix BR·João Pedro Tricta BR Lyra: An LLVM IR Obfuscator for Rust

  Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust's unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach.

  This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal "cargo build" via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline, string encryption, basic-block shuffling, indirect-branch obfuscation, recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project's source code, one flag on the command line.

  We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell's undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja. We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build.

  Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day.

  ResearchersRafael Felix BR·João Pedro Tricta BR

  Presented at BSides Las Vegas 2026

  View official session
• August 4, 2026 Talk Malware & Reversing BSides Las Vegas 2026 Diego Tellaroli BR Finding vulnerabilities in windows kernel drivers & performing BYOVD attacks

  In this talk, we will cover reverse engineering Windows kernel-mode drivers, identifying vulnerabilities, and performing BYOVD (Bring Your Own Vulnerable Driver) attacks. We will learn techniques to exploit driver vulnerabilities in order to bypass EDRs or gain kernel-level permissions. Additionally, we will review BYOVD attacks carried out by real APTs and how they disable EDRs and antivirus software using kernel-mode techniques.

  ResearchersDiego Tellaroli BR

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Workshop Incident Response BSides Las Vegas 2026 Rodrigo Montoro BR AWS Principal Threat Hunting: Behavioral Baselining for Malicious Activity

  Cloud security encounters attacks that elude standard detection. In AWS, unauthorized access keys are a common cause of breaches. The vastness of AWS, over 450 services and 19,000 API actions, complicates threat visibility and exposes gaps in traditional tools. This workshop empowers participants with direct, hands-on experience using the AWS Threat Hunter tool to improve threat detection.

  Attendees will focus on building behavioral baselines and leveraging data-driven analysis to detect subtle AWS principal anomalies, enabling more precise detection than traditional event monitoring. Attendees will move beyond standard techniques by building multi-stage detection pipelines that create individualized baselines for each IAM principal and systematically flag personalized deviations, linking outliers directly to risks.

  ResearchersRodrigo Montoro BR

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Training Incident Response Black Hat USA 2026 Mariano E Quintana AR·Felipe Barbosa Alves BR Adversary Tradecraft Decoded: CTI from Zero to Hero

  Adversary Tradecraft Decoded: CTI from Zero to Hero is an immersive training program designed to bridge the gap between foundational cybersecurity knowledge and the practical, operational use of Cyber Threat Intelligence (CTI). This course provides a structured path for participants to transform raw adversary tradecraft into actionable intelligence products that support detection, response, and strategic defense.

  Starting from first principles, attendees will explore the intelligence lifecycle, types of CTI, and the role of cognitive biases in analysis. The course then advances into the practical decoding of adversary Tactics, Techniques, and Procedures (TTPs), mapping them against frameworks such as MITRE ATT&CK to create consistent and reliable intelligence outputs. Participants will learn to apply open standards (STIX, TAXII, OpenIOC), enrichment methods, and structured analytic techniques to normalize and contextualize threat data.

  The centerpiece of the training is a cloud-based lab environment that recreates realistic attack scenarios in a safe and controlled setting. Participants will investigate a simulated phishing and privilege escalation incident, reconstruct the cyber kill chain using the Diamond Model, extract indicators, and identify adversary behaviors. Through guided exercises, they will practice building competing hypotheses (ACH), mitigate the influence of analytical bias, and ultimately produce both technical and executive-level CTI reports.

  What makes this program unique is its dynamic and in-depth approach to understanding how intelligence is truly built, not just as a theoretical exercise, but as the foundation for making future decisions about whether and how to share it. Learners are pushed to challenge their own hypotheses and identify the biases inherent in the analytic process. While they work through a known case, the procedures and steps they follow can be directly applied to generating new, useful intelligence beyond the classroom.

  This hands-on, end-to-end process ensures that learners not only grasp the theory of CTI but also experience how to operationalize it in passive defense and threat hunting contexts. By simulating the work of real-world analysts, participants will leave with the ability to generate intelligence products that directly support security operations, reduce uncertainty in incident response, and inform decision-making at tactical, operational, and strategic levels.

  ResearchersMariano E Quintana AR·Felipe Barbosa Alves BR

  Presented at Black Hat USA 2026

  View official session
• May 22, 2026 Talk Incident Response Ekoparty Miami 2026 Jefferson Macedo BR Inside a $15M Cyber Heist: From Home Router Intrusions to Social Engineering (UNCENSORED)

  In this session, we’ll dive into a multi-stage attack campaign that resulted in a major financial fraud in Brazil, where a threat group escalated from rudimentary network intrusions - leveraging compromised home and small business routers - to a highly effective social engineering operation targeting contact center operators. Drawing from firsthand forensic investigations, we’ll walk through the group’s initial tactics, including physical implants and unauthorized access in remote branches, and how these evolved into a sophisticated social engineering vector that ultimately enabled a $15M (USD) fraud. You’ll see how the attackers adapted over time, exploited both technical and human vulnerabilities, and maintained persistence in the environment. This talk will present timeline reconstruction, threat actor behavior, missed detection opportunities, and key lessons learned - offering actionable insights for defenders, red teamers, and incident responders alike.

  ResearchersJefferson Macedo BR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk AI Security Ekoparty Miami 2026 Rafael Soares Ferreira BR AI red teaming and security evaluation techniques

  This talk provides a practical approach to evaluating LLM and Generative AI vulnerabilities. The presentation will cover how initiatives like OWASP Top10 for LLM and the Gen AI Red Teaming Guide can support standardized AI security assessments and adversarial testing practices.

  ResearchersRafael Soares Ferreira BR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk Incident Response Ekoparty Miami 2026 Diego Matos Martins BR·Wesley Silva BR Who's by Your Side? From Insider to APT: Latin American Financial System under Attack

  What if the most sophisticated attack against your institution didn't come from a foreign group or a global campaign, but from the badge that walks past you every day?

  In this talk, we reveal the behind-the-scenes of an investigation that exposed a case of corporate espionage in the Latin American financial sector, where the line between organized crime and an APT becomes dangerously thin.

  ResearchersDiego Matos Martins BR·Wesley Silva BR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk AppSec & Supply Chain Ekoparty Miami 2026 Rafael Soares Ferreira BR Exploitation techniques for the OWASP Top10

  This talk provides a practical overview of exploitation techniques aimed at the most critical web application vulnerabilities from the OWASP Top 10. The presentation highlights how Artificial Intelligence can help at various stages of the exploitation process, including reconnaissance, creating payloads, automation, analysis, and researching vulnerabilities.

  ResearchersRafael Soares Ferreira BR

  Presented at Ekoparty Miami 2026

  View official schedule