Research connected to Ecuador

• August 8, 2026 Workshop AI Security La Villa Hacker — DEF CON 2026 Luis Pazmiño EC Before the SIEM Blinks: How AI Memory Turns Alerts into Intelligence

  La mayoría de los SOCs son reactivos por diseño: los eventos llegan, se almacenan, se correlacionan horas después, y en el mejor de los casos un analista los revisa cuando puede. Este workshop rompe ese modelo. Presentamos una arquitectura SOC-less impulsada por IA donde la detección ocurre en línea, antes de que los datos lleguen al SIEM, usando reglas Sigma traducidas a lógica ejecutable en Groovy. Cuando una regla hace match, el evento se enriquece al instante con contexto de usuario, criticidad del activo, estructura de procesos y técnicas asociadas a MITRE ATT&CK.

  El diferenciado de nuestra propuesta es la memoria. Cada alerta, ticket, resolución, triaje de analista y falso positivo alimenta un índice recurrente. los agentes consultan ese historial para determinar si una detección es nueva, recurrente, vinculada a un activo crítico o parte de un patrón conocido, luego generan el ticket, sugieren severidad, recomiendan la contención y, en escenarios controlados la ejecutan. El resultado del flujo es la detección y respuesta inicial medidas en segundos, no en turnos de analistas.

  ResearchersLuis Pazmiño EC

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• May 22, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Danilo Erazo EC From Pentest to Hacktivism: A Journey into 6 Zero Days Hidden in widely used Routers

  This talk tells the story of how a routine penetration test of one day became a months long solo journey into uncovering six zero day vulnerabilities in a home ONT router used all over the world, but especially across the American continent, including the United States, Canada, Argentina, Mexico, Brazil, and Ecuador.

  In 2025, I was hired by an Ecuadorian entity after an ISP detected suspicious activity impacting its own infrastructure, potentially originating from users of these routers. They needed to understand what was happening. What began as a standard assessment quickly went far beyond typical testing. Instead of stopping at network level analysis with a port scan and check vulnerable services, I moved deeper into hardware hacking and firmware reverse engineering. What I found was unexpected. A massively deployed router with no prior CVEs!!!. That absence was not reassuring, it was suspicious. Working completely alone, I faced significant technical challenges, including reversing firmware built on the uncommon ARCompact architecture. Step by step, this led to the discovery of five zero day vulnerabilities.

  At that point, I was facing a difficult situation. The vendor initially refused to patch the vulnerabilities, even though there were around 60,000 of these end of life routers still in use just in one of the affected countries and many more deployed worldwide. Given the scale and urgency, I briefly considered turning to the black market as a way to force attention to the issue. However, I ultimately chose responsible disclosure instead (but I discovered a big black market about zero days in routers). What followed was a difficult, months long process with the vendor that eventually resulted in five CVEs and the patch in 2025. To make progress, I had to adopt a more assertive, hacktivist style approach with the vendor after their initial refusal to address the flaws (the timeline is quite emotional!).

  In March 2026, after I published the CVEs in my blog, an anonymous hacker contacted me. He had read my work and revealed something unexpected. He was the author of a sixth zero day vulnerability affecting the same routers, one I had previously come across without knowing its origin. What started as an individual effort suddenly connected to a hidden parallel discovery (in total 6 zero days were in the underground/undiscovered for more than 10 years)

  In March 20, 2026, I verified the vulnerability and conducted a global reassessment of these routers. The results are quite interesting. These devices are already end of life, yet they are still being used all over the world, with official support extended until 2027/2028. The message: EOL routers are very serious risk!"

  ResearchersDanilo Erazo EC

  Presented at Ekoparty Miami 2026

  View official schedule