Black Hat USA 2026

You don't realize it until you see them; they are everywhere. From Wireless ISPs links, to the frontline of modern warfare. But no one found anything?

Long-haul WiFi Links, specifically Ubiquiti AirMax. These devices are a critical part of networks running a 17 year old Linux kernel and a custom 802.11 extension that relies on the well-known "security by obscurity".

This Briefing is about the reverse engineering of Ubiquiti's Airmax protocol, its AirOS, and its kernel modules in charge of this proprietary wireless mode. This is implemented on top of IEEE 802.11 Information Elements that look encrypted, but we will shed light and show you why they aren't.

We found these devices were insecure, and we have evidence. Two critical vulnerabilities (CVE-2026-21639 and CVE-2026-21638) that affect seven device families, including airMAX AC, airMAX M, airFiber and GigaBeam platforms (over 50 currently-sold devices). These vulnerabilities are like the ones in movies, Over-The-Air unauthenticated remote code execution with kernel privileges, no network access, just line of sight. The bugs found affect all Airmax devices since inception.

Vulnerabilities found by this research were responsibly reported through the official bug bounty program. They were rated in a lower tier, as "Adjacent", but this bug can be exploited kilometers away.

Nonetheless, we will show how to use the same devices as recon tools and provide another open-source software to analyze and locate networks using this protocol.

This Briefing is not only for showing vulnerabilities, but we also want you to know the state of security in these devices. We want to share our journey and share the tooling and discoveries we made along the way.

Takeaway

• Reconnaissance and network mapping: They will learn how to identify, enumerate, and map networks composed of these devices.
• Remote exploitation of WISP infrastructure: Attendees will learn how we can exploit 2 new vulnerabilities at range against deployed wireless devices.
• A roadmap for future research: We highlight device families we believe are still vulnerable and largely unexplored, giving attendees clear starting points to keep digging.

ResearchersGaston Aznarez ARFederico Kirschbaum ARDan Borgogno AR

Adversary Tradecraft Decoded: CTI from Zero to Hero is an immersive training program designed to bridge the gap between foundational cybersecurity knowledge and the practical, operational use of Cyber Threat Intelligence (CTI). This course provides a structured path for participants to transform raw adversary tradecraft into actionable intelligence products that support detection, response, and strategic defense.

Starting from first principles, attendees will explore the intelligence lifecycle, types of CTI, and the role of cognitive biases in analysis. The course then advances into the practical decoding of adversary Tactics, Techniques, and Procedures (TTPs), mapping them against frameworks such as MITRE ATT&CK to create consistent and reliable intelligence outputs. Participants will learn to apply open standards (STIX, TAXII, OpenIOC), enrichment methods, and structured analytic techniques to normalize and contextualize threat data.

The centerpiece of the training is a cloud-based lab environment that recreates realistic attack scenarios in a safe and controlled setting. Participants will investigate a simulated phishing and privilege escalation incident, reconstruct the cyber kill chain using the Diamond Model, extract indicators, and identify adversary behaviors. Through guided exercises, they will practice building competing hypotheses (ACH), mitigate the influence of analytical bias, and ultimately produce both technical and executive-level CTI reports.

What makes this program unique is its dynamic and in-depth approach to understanding how intelligence is truly built, not just as a theoretical exercise, but as the foundation for making future decisions about whether and how to share it. Learners are pushed to challenge their own hypotheses and identify the biases inherent in the analytic process. While they work through a known case, the procedures and steps they follow can be directly applied to generating new, useful intelligence beyond the classroom.

This hands-on, end-to-end process ensures that learners not only grasp the theory of CTI but also experience how to operationalize it in passive defense and threat hunting contexts. By simulating the work of real-world analysts, participants will leave with the ability to generate intelligence products that directly support security operations, reduce uncertainty in incident response, and inform decision-making at tactical, operational, and strategic levels.

ResearchersMariano E Quintana ARFelipe Barbosa Alves BR

This intensive two-day training teaches you how to understand, detect, and investigate modern malware attacks through hands-on network traffic analysis. Instead of relying on tools or dashboards, you will learn to recognize malicious behavior by developing analytical skills, technical intuition, and a solid methodology drawn from real incidents.

Across nine modules, you will analyze real-world captures, build timelines, and learn to separate normal from malicious activity. You will investigate ransomware behavior, botnet communications, DGAs, encrypted traffic, and custom protocols. You will also generate and analyze network logs and use machine learning.

The training combines short theory blocks with guided labs, peer discussions, and exercises distilled from decades of experience in traffic analysis. By the end, you will have the confidence and methodology required to analyse traffic and make informed decisions during real incidents.

ResearchersVerónica Valeros ARSebastián García AR