Malware & Reversing research

• August 9, 2026 Talk Malware & Reversing Red Team Village — DEF CON 2026 Eduardo Chavarro Ovalle CO·Ashley Hiram MX·Alexander Rodchenko Evil Is Always a Bad Stylist: .NET Obfuscation with Roslyn

  Modern endpoint defenses increasingly fingerprint .NET tools not only by strings and imports, but by structure: control flow, call graphs, and overall execution "workflows." Traditional IL obfuscation can hide obvious indicators, yet often produces highly regular flattened patterns that are easy to flag on their own.

  This talk presents a Roslyn-based, source-to-source obfuscator for C# that rewrites an entire project before compilation. Using the official compiler APIs, it transforms the code's syntax and semantic structure, reshapes control/data flow, and then recompiles the result - while keeping the program's observable behavior intact. The output tends to look complex but "natural," diverging both from the original tool and from the telltale patterns created by many IL-level obfuscators.

  I will walk through the pipeline, show how surprisingly little code is needed to build these transformations on Roslyn, and discuss what this means for EDR, sandboxing, and ML detections that rely on graph and workflow analysis of .NET binaries.

  So, anyway, on moment of submitting original Seatbelt tool (obfuscated by source) have 10/73 security vendors flagged this file as malicious (can be better).

  My project https://github.com/gam4er/Loaders differs from more well known https://github.com/sadreck/Codecepticon by implementing semantic structure obfuscation.

  My point of view (as a SOC analyst, blue teamer) on "how to hide my tool from AV" problem is: if you have a code — OBFUSCATE YOUR CODE. Stop modifying binaries.

  ResearchersEduardo Chavarro Ovalle CO·Ashley Hiram MX·Alexander Rodchenko

  Presented at Red Team Village — DEF CON 2026

  View official session Loaders on GitHub
• August 8, 2026 Talk Malware & Reversing Malware Village — DEF CON 2026 Nelson Rafael Colón Merán DO Haetae: An Agent to Takedown North Korean C2 Servers

  In this talk, we introduce Haetae, an agent designed to profile, identify, and exploit C2 frameworks used by North Korean malware.

  Haetae supports both automated and interactive modes, allowing analysts to map and understand adversary infrastructure with different levels of control. It is built around a flexible rule-based system, enabling users to extend and refine detections as new patterns and frameworks emerge.

  In this first release, we will walk through real-world cases where Haetae was used to identify and take down infrastructure associated with Mach-O Man and POWerful Armadillo.

  We will also release a safe emulator of both malware C2 servers, allowing researchers and newcomers to experiment with Haetae in realistic, controlled environments without risk.

  This is a highly technical talk but can be enjoyed by both beginners and seasoned threat hunters alike.

  ResearchersNelson Rafael Colón Merán DO

  Presented at Malware Village — DEF CON 2026

  View official session
• August 8, 2026 Talk Malware & Reversing DEF CON 34 Federico Kirschbaum AR·Gaston Aznarez AR Root From Kilometers Away: Ubiquiti AirMax RCE

  You don't realize it until you see them; they're everywhere. From Wireless ISP links to the frontline of modern warfare. But nobody found anything? The devices behind those links are Ubiquiti AirMAX: critical infrastructure on a 17-year-old Linux kernel and a custom 802.11 extension built on "security by obscurity." So we took it apart. This talk covers our reverse engineering of the AirMAX protocol, AirOS, and the kernel modules behind this proprietary mode. It rides on 802.11 Information Elements that look encrypted, but we'll show why they aren't. What we found: two critical vulnerabilities (CVE-2026-21639, CVE-2026-21638) across airMAX AC, airMAX M, airFiber, and GigaBeam, over 50 devices. These are the bugs from the movies: Over-The-Air, unauthenticated, kernel-privilege RCE. No network access, just line of sight. They affect every AirMAX device ever shipped. We disclosed them through Ubiquiti's bug bounty program. The bugs were rated "Adjacent", except adjacent here means kilometers away. The same hardware can be turned around and pointed at the problem: we'll repurpose these devices as recon tools and release open-source software to locate AirMAX networks in the wild. This talk is about our journey, our tooling, and the state of security.

  ResearchersFederico Kirschbaum AR·Gaston Aznarez AR

  Presented at DEF CON 34

  View official session
• August 8, 2026 Talk Malware & Reversing La Villa Hacker — DEF CON 2026 María Isabel Manjarrez MX Malware Inc.: Cybercrime-as-a-Service y la economía del cibercrimen moderno

  El cibercrimen moderno dejó atrás el modelo del atacante aislado. Hoy existe un ecosistema modular y altamente especializado donde servicios como Malware-as-a-Service (MaaS), Ransomware-as-a-Service (RaaS), Pay-Per-Install (PPI), Initial Access Brokers (IAB) o Phishing-as-a-Service (PhaaS) permiten que distintos actores colaboren dentro de una cadena de suministro criminal distribuida.

  En esta charla exploraremos cómo el malware adoptó principios de industrialización similares a los de la industria tecnológica legítima: afiliados, automatización, revenue sharing, soporte técnico y servicios bajo demanda. A través de casos reales revisaremos cómo funciona esta economía clandestina, cómo se monetizan distintas etapas de un ataque y por qué entender el modelo de negocio detrás del malware es clave para comprender las amenazas actuales.

  ResearchersMaría Isabel Manjarrez MX

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Talk Malware & Reversing La Villa Hacker — DEF CON 2026 Filipi Pires BR From Live Malware to Red Team Tradecraft: Process Hollowing in msbuild.exe

  The best hiding place is often a binary Microsoft already signed. This talk presents a complete red team operation reconstructed from a real multi-stage JScript dropper captured in April 2026 targeting Energy, Government, and Aerospace organizations. Using custom tooling and malware analysis, we transformed the adversary's workflow into a repeatable offensive playbook focused on trusted binary abuse, fileless execution, and stealthy process injection.

  The session demonstrates how attackers delivered a .NET payload through steganographic C2 hosted on trusted paste services, loaded assemblies directly in memory with Reflection.Assembly::Load(), and performed Process Hollowing into msbuild.exe using native Windows APIs including ZwUnmapViewOfSection, VirtualAllocEx, and SetThreadContext.

  We also explore operational evasion techniques such as WMI hidden process spawning, obfuscated Base64 transformations, and Sysmon telemetry analysis from the perspective of a red team operator. Every technique shown was extracted from a live adversary sample and operationalized for realistic adversary emulation.

  ResearchersFilipi Pires BR

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 8, 2026 Talk Malware & Reversing Malware Village — DEF CON 2026 Lisandro Ubiedo AR·Leandro Cuozzo AR How to destroy a country

  Some people just want to see the whole world burn. And some cyberwarfare units just want your systems to go pufff.

  Wipers are the cyber version of napalm, taking destruction from the kinetic to the cyberspace, and have been the most utilized weapons by cyberwars in the last decade. These wipers are design to destroy everything that they can get their hands on to: files, disks, backups, you name it. And they are purposefully designed this way by a dedicated group with their destabilizing a whole country in times of war.

  In this talk we are going to go through the history of wipers, since our discovery of Flame in 2012 to our latest research on a destructive wiper we named Lotus Wiper. We are going to go through the technical details as well as providing a panoramic view to the impact that these types of cyberweapons have on countries, companies and people around the globe.

  ResearchersLisandro Ubiedo AR·Leandro Cuozzo AR

  Presented at Malware Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Malware & Reversing La Villa Hacker — DEF CON 2026 Josep Albors MX El regreso de Sedinho: situación actual y nuevas tácticas de los troyanos bancarios brasileños

  Esta investigación analiza la evolución reciente de los troyanos bancarios brasileños y su expansión internacional, así como las acciones de las autoridades para frenarlos. Se examinan campañas actuales impulsadas por ciberdelincuentes latinoamericanos que no solo perfeccionan el malware bancario tradicional, sino que también incorporan fraudes móviles basados en tecnología NFC.

  ResearchersJosep Albors MX

  Presented at La Villa Hacker — DEF CON 2026

  View official session
• August 7, 2026 Talk Malware & Reversing Adversary Village — DEF CON 2026 Mauro Eldritch AR·Nelson Rafael Colón Merán DO Haetae: An Agent to Takedown North Korean C2 Servers

  In this talk, we introduce Haetae, an agent designed to profile, identify, and exploit C2 frameworks used by North Korean malware.

  Haetae supports both automated and interactive modes, allowing analysts to map and understand adversary infrastructure with different levels of control. It is built around a flexible rule-based system, enabling users to extend and refine detections as new patterns and frameworks emerge.

  In this first release, we will walk through real-world cases where Haetae was used to identify and take down infrastructure associated with Mach-O Man and POWerful Armadillo.

  We will also release a safe emulator of both malware C2 servers, allowing researchers and newcomers to experiment with Haetae in realistic, controlled environments without risk.

  This is a highly technical talk but can be enjoyed by both beginners and seasoned threat hunters.

  ResearchersMauro Eldritch AR·Nelson Rafael Colón Merán DO

  Presented at Adversary Village — DEF CON 2026

  View official session
• August 7, 2026 Workshop Malware & Reversing Red Team Village — DEF CON 2026 Mauro Eldritch AR·Nelson Rafael Colón Merán DO Haetae: An Agent to Takedown North Korean C2 Servers

  In this talk, we introduce Haetae, an agent designed to profile, identify, and exploit C2 frameworks used by North Korean malware.

  Haetae supports both automated and interactive modes, allowing analysts to map and understand adversary infrastructure with different levels of control. It is built around a flexible rule-based system, enabling users to extend and refine detections as new patterns and frameworks emerge.

  In this first release, we will walk through real-world cases where Haetae was used to identify and take down infrastructure associated with Mach-O Man and POWerful Armadillo.

  We will also release a safe emulator of both malware C2 servers, allowing researchers and newcomers to experiment with Haetae in realistic, controlled environments without risk.

  This is a highly technical talk but can be enjoyed by both beginners and seasoned threat hunters.

  ResearchersMauro Eldritch AR·Nelson Rafael Colón Merán DO

  Presented at Red Team Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Malware & Reversing Malware Village — DEF CON 2026 Mauro Eldritch AR North Korea's Zoo: Poaching for Gophers, Armadillos and RATs

  In this talk, a continuation of the North Korea's Zoo series, we take apart three new malware samples linked to North Korean operators: a fresh iteration of GoLangGhostRAT, POWerful Armadillo (a rework of Digit Stealer), and Mach-O Man, a new macOS malware kit. All of them were first-spotted and reversed by our team.

  We will focus on what actually matters: interesting bits of code, mistakes in their infrastructure, and how we were able to abuse their C2 to profile campaigns and mess with their operations.

  We'll also cover how these samples are being distributed, including some newer tricks we've been seeing in the wild.

  At several points, we ended up talking directly with the operators themselves. We'll be sharing those interactions here for the first time.

  This talk can be enjoyed by both beginners and seasoned threat hunters alike.

  ResearchersMauro Eldritch AR

  Presented at Malware Village — DEF CON 2026

  View official session
• August 7, 2026 Talk Malware & Reversing Malware Village — DEF CON 2026 Rafael Felix BR Lyra: An LLVM IR Obfuscator for Rust

  Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust's unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach.

  This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal "cargo build" via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline, string encryption, basic-block shuffling, indirect-branch obfuscation, recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project's source code, one flag on the command line.

  We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell's undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja.

  We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build.

  Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day.

  ResearchersRafael Felix BR

  Presented at Malware Village — DEF CON 2026

  View official session
• August 6, 2026 Talk Malware & Reversing Black Hat USA 2026 Gaston Aznarez AR·Federico Kirschbaum AR·Dan Borgogno AR Root From Kilometers Away: Ubiquiti AirMax RCE

  You don't realize it until you see them; they are everywhere. From Wireless ISPs links, to the frontline of modern warfare. But no one found anything?

  Long-haul WiFi Links, specifically Ubiquiti AirMax. These devices are a critical part of networks running a 17 year old Linux kernel and a custom 802.11 extension that relies on the well-known "security by obscurity".

  This Briefing is about the reverse engineering of Ubiquiti's Airmax protocol, its AirOS, and its kernel modules in charge of this proprietary wireless mode. This is implemented on top of IEEE 802.11 Information Elements that look encrypted, but we will shed light and show you why they aren't.

  We found these devices were insecure, and we have evidence. Two critical vulnerabilities (CVE-2026-21639 and CVE-2026-21638) that affect seven device families, including airMAX AC, airMAX M, airFiber and GigaBeam platforms (over 50 currently-sold devices). These vulnerabilities are like the ones in movies, Over-The-Air unauthenticated remote code execution with kernel privileges, no network access, just line of sight. The bugs found affect all Airmax devices since inception.

  Vulnerabilities found by this research were responsibly reported through the official bug bounty program. They were rated in a lower tier, as "Adjacent", but this bug can be exploited kilometers away.

  Nonetheless, we will show how to use the same devices as recon tools and provide another open-source software to analyze and locate networks using this protocol.

  This Briefing is not only for showing vulnerabilities, but we also want you to know the state of security in these devices. We want to share our journey and share the tooling and discoveries we made along the way.

  Takeaway

  • Reconnaissance and network mapping: They will learn how to identify, enumerate, and map networks composed of these devices.
  • Remote exploitation of WISP infrastructure: Attendees will learn how we can exploit 2 new vulnerabilities at range against deployed wireless devices.
  • A roadmap for future research: We highlight device families we believe are still vulnerable and largely unexplored, giving attendees clear starting points to keep digging.

  ResearchersGaston Aznarez AR·Federico Kirschbaum AR·Dan Borgogno AR

  Presented at Black Hat USA 2026

  View official session
• August 4, 2026 Talk Malware & Reversing BSides Las Vegas 2026 Rafael Felix BR·João Pedro Tricta BR Lyra: An LLVM IR Obfuscator for Rust

  Rust is rapidly becoming the language of choice for red team tooling, implants, and security-critical software. Yet the offensive security ecosystem has almost no obfuscation tooling for it. Nearly every production obfuscator targets C/C++ binaries or operates on final PE/ELF images; Rust's unique compile pipeline, name mangling, and LLVM IR patterns require a fundamentally different approach.

  This talk presents Lyra, an open-source, cargo-native LLVM IR obfuscator for Rust. Lyra intercepts each crate during a normal "cargo build" via RUSTC_WRAPPER, transforms the LLVM IR with a configurable pass pipeline, string encryption, basic-block shuffling, indirect-branch obfuscation, recompiles the result with llc + clang, and substitutes the object before the real MSVC linker runs. Zero changes to the Rust compiler, zero changes to the target project's source code, one flag on the command line.

  We walk through the architecture, the engineering challenges unique to Windows/MSVC (UTF-16 response files, allocator-shim object preservation, inkwell's undocumented panic guards), and live before-and-after demonstrations in IDA Pro, Ghidra, and Binary Ninja. We also show a YARA rule that confidently matches a plain demo build returning zero results on the obfuscated binary, and two consecutive unseeded builds producing different hex patterns, defeating a rule written on the first build.

  Lyra is released open-source at the time of the talk. All demos are reproducible from the release. Attendees leave with a working tool they can run against their own Rust projects the same day.

  ResearchersRafael Felix BR·João Pedro Tricta BR

  Presented at BSides Las Vegas 2026

  View official session
• August 4, 2026 Talk Malware & Reversing BSides Las Vegas 2026 Diego Tellaroli BR Finding vulnerabilities in windows kernel drivers & performing BYOVD attacks

  In this talk, we will cover reverse engineering Windows kernel-mode drivers, identifying vulnerabilities, and performing BYOVD (Bring Your Own Vulnerable Driver) attacks. We will learn techniques to exploit driver vulnerabilities in order to bypass EDRs or gain kernel-level permissions. Additionally, we will review BYOVD attacks carried out by real APTs and how they disable EDRs and antivirus software using kernel-mode techniques.

  ResearchersDiego Tellaroli BR

  Presented at BSides Las Vegas 2026

  View official session
• August 3, 2026 Training Malware & Reversing Black Hat USA 2026 Verónica Valeros AR·Sebastián García AR Advanced Malware Traffic Analysis

  This intensive two-day training teaches you how to understand, detect, and investigate modern malware attacks through hands-on network traffic analysis. Instead of relying on tools or dashboards, you will learn to recognize malicious behavior by developing analytical skills, technical intuition, and a solid methodology drawn from real incidents.

  Across nine modules, you will analyze real-world captures, build timelines, and learn to separate normal from malicious activity. You will investigate ransomware behavior, botnet communications, DGAs, encrypted traffic, and custom protocols. You will also generate and analyze network logs and use machine learning.

  The training combines short theory blocks with guided labs, peer discussions, and exercises distilled from decades of experience in traffic analysis. By the end, you will have the confidence and methodology required to analyse traffic and make informed decisions during real incidents.

  ResearchersVerónica Valeros AR·Sebastián García AR

  Presented at Black Hat USA 2026

  View official session
• May 22, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Asher Davila MX Lost in Disassembly: Building an LLM-Powered Toolkit for Reverse Engineering

  This session describes a practical reverse engineering workflow developed while analyzing different types of binaries. The talk focuses on combining manual reverse engineering with AI-assisted tools inside an existing workflow. These tools are used to support tasks such as function labeling, identifying runtime structures, and building an initial understanding of binary capabilities, allowing the analyst to spend more time on deeper analysis and validation.The methodology presented is based on hands-on analysis of active threats collected from Palo Alto Networks firewalls and WildFire. The samples include Go-based IoT botnets, OT-centric malware, and Android malware targeting TVs. Our analysis was performed using disassemblers and decompilers (radare2, Ghidra, IDA Pro), extended with AI agents integrated directly into the disassembler environment. The emphasis is on what worked, what did not, and where human analysis remains essential.

  ResearchersAsher Davila MX

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Danilo Erazo EC From Pentest to Hacktivism: A Journey into 6 Zero Days Hidden in widely used Routers

  This talk tells the story of how a routine penetration test of one day became a months long solo journey into uncovering six zero day vulnerabilities in a home ONT router used all over the world, but especially across the American continent, including the United States, Canada, Argentina, Mexico, Brazil, and Ecuador.

  In 2025, I was hired by an Ecuadorian entity after an ISP detected suspicious activity impacting its own infrastructure, potentially originating from users of these routers. They needed to understand what was happening. What began as a standard assessment quickly went far beyond typical testing. Instead of stopping at network level analysis with a port scan and check vulnerable services, I moved deeper into hardware hacking and firmware reverse engineering. What I found was unexpected. A massively deployed router with no prior CVEs!!!. That absence was not reassuring, it was suspicious. Working completely alone, I faced significant technical challenges, including reversing firmware built on the uncommon ARCompact architecture. Step by step, this led to the discovery of five zero day vulnerabilities.

  At that point, I was facing a difficult situation. The vendor initially refused to patch the vulnerabilities, even though there were around 60,000 of these end of life routers still in use just in one of the affected countries and many more deployed worldwide. Given the scale and urgency, I briefly considered turning to the black market as a way to force attention to the issue. However, I ultimately chose responsible disclosure instead (but I discovered a big black market about zero days in routers). What followed was a difficult, months long process with the vendor that eventually resulted in five CVEs and the patch in 2025. To make progress, I had to adopt a more assertive, hacktivist style approach with the vendor after their initial refusal to address the flaws (the timeline is quite emotional!).

  In March 2026, after I published the CVEs in my blog, an anonymous hacker contacted me. He had read my work and revealed something unexpected. He was the author of a sixth zero day vulnerability affecting the same routers, one I had previously come across without knowing its origin. What started as an individual effort suddenly connected to a hidden parallel discovery (in total 6 zero days were in the underground/undiscovered for more than 10 years)

  In March 20, 2026, I verified the vulnerability and conducted a global reassessment of these routers. The results are quite interesting. These devices are already end of life, yet they are still being used all over the world, with official support extended until 2027/2028. The message: EOL routers are very serious risk!"

  ResearchersDanilo Erazo EC

  Presented at Ekoparty Miami 2026

  View official schedule
• May 22, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Mario Lobo CO La Nueva Ciberguerra No Lineal: De la Defensa Perimetral a la Inteligencia de Comportamiento

  El mayor error estratégico de un líder de ciberseguridad es diseñar arquitecturas para mitigar las amenazas del pasado. Durante décadas, operamos bajo el modelo perimetral tradicional ("Fuerza contra Fuerza"), asumiendo que el tráfico interno era confiable y el externo hostil. Hoy, ese modelo ha colapsado ante La Nueva Ciberguerra No Lineal, un escenario de amenazas asimétricas donde los atacantes han dejado de usar malware tradicional. Ya no traen sus propias armas; usan las nuestras. Mediante tácticas de Living off the Land (LotL), operan en modo sigiloso abusando de herramientas administrativas legítimas para camuflarse en el ruido diario de la infraestructura corporativa.

  Esta sesión es un llamado a la toma de conciencia estratégica. A través del análisis de ejemplos reales y patrones de ataque modernos, expondremos cómo esta amenaza invisible ya está vulnerando los enfoques tradicionales. Ante la fricción operativa que impide alcanzar un modelo Zero Trust perfecto, los asistentes comprenderán la urgencia de adoptar medidas estratégicas basadas en la "asunción de brecha" (Assume Breach). Discutiremos cómo evolucionar de la dependencia de controles estáticos hacia la Inteligencia de Comportamiento y la Evaluación Continua de Compromiso (CCA), la única vía para cazar las anomalías que delatan al adversario cuando las firmas y los binarios fallan.

  Basada en el artículo "The New Non-linear Cyberwarfare", esta sesión traslada las lecciones críticas de la evolución militar al escenario cibernético moderno. Analizaremos cómo el cambio histórico de la guerra lineal a tácticas asimétricas se ha convertido en la innegable realidad de los ciberataques actuales.

  ResearchersMario Lobo CO

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Bruno Fonseca PE Malware in Fake Banking Toolkit Apps and Root Abuse

  Traditional mobile security is based on the assumption that the operating system is a trusted environment. However, within the mobile phone repair ecosystem, automated “one-click” tools that claim to bypass protection mechanisms and conceal Root status from financial applications have become increasingly widespread.

  This presentation analyzes how these types of tools can operate as part of hybrid Malware-as-a-Service (MaaS) schemes, combining evasion techniques on mobile devices with the distribution of information-stealing malware targeting the computers used by technicians. Through reverse engineering, dynamic analysis, and C2 infrastructure research, the operational behavior of these threats is exposed, along with their impact on the trust chain of the mobile ecosystem.

  ResearchersBruno Fonseca PE

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Christian Urcuqui CO When Malware Learns to Lie: Adversarial Machine Learning en detección y resiliencia de ransomware

  Los modelos de machine learning ya son utilizados para detectar malware y ransomware en entornos reales. Pero ¿qué ocurre cuando el atacante comienza a manipular directamente al modelo? Esta charla presenta cómo técnicas de adversarial machine learning pueden ser utilizadas para evadir sistemas de detección de ransomware y cómo estos mismos ataques permiten diseñar defensas más resilientes. A partir de un caso práctico, se explorará el paso de una perspectiva ofensiva a una estrategia defensiva basada en robustez y seguridad de modelos.

  ResearchersChristian Urcuqui CO

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Gaston Aznarez AR·Dan Borgogno AR No Spec, No Problem: Automated ISA reverse engineering with Multi-Agent AI

  What happens when you are reverse engineering a device and you hit the wall? You found that the device’s architecture is not X86, no ARM, no MIPS, it’s just a proprietary architecture with basic information available online. You know you can reverse engineer a full Instruction Set Architecture (from now, ISA), but it is going to take a lot of time and effort. So we asked ourselves: can AI do the tedious work for us?

  The instructions for the processor are not more than bits, but for us, it could be translated to assembly instructions. This assembly is just a human-readable encoding of bits, and it could be completely novel. And finding the relation between this semantics and the bits is a really tedious job, so why not let this to the AI?

  In this talk, we propose a methodology to automatically reverse engineer ISAs using a multi-agent AI pipeline. The approach combines deterministic bit-level analysis with LLM reasoning to recover the ISA from a JieLi JL7012F6 processor, taking as input the disassembled instructions from the vendor's toolchain and producing a processor specification for Ghidra.

  Beyond the tool we develop and release, this talk explores new ways in which AI can help in the reverse engineering process and proves the capacity of this technology in this field. Today, AI focuses on the higher levels of computation, but it is really useful in the lower levels too; we just have to find the fit.

  ResearchersGaston Aznarez AR·Dan Borgogno AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Matias Perez Fumega AR Your smart home is hackable: A practical introduction to Hardware Security

  Smart devices in your house are likely vulnerable and easy to hack. This talk will show you how to. Using a handful of cheap tools such as a UART to TTL adapter, an RTL-SDR dongle, and some open-source software, we'll walk you through the process of how I hacked two real targets from scratch. Don’t worry if you don’t know what UART or TTL means, we have you covered.

  First, we will explore how a Smart Display was compromised, from gaining initial access to reverse engineering the device and identifying vulnerabilities along the way. Then, we will analyze how a commercial weather station's RF protocol was decoded and how custom data was injected into it.

  Along the way, we'll cover the basics: initial reconnaissance of an electronic board, how to identify debug interfaces, and how to approach an unknown radio frequency signal. No prior hardware experience. No expensive lab. Just cheap hardware, open-source tools, and curiosity. Hopefully, you’ll walk away having a plan to start your journey in the hardware hacking world.

  ResearchersMatias Perez Fumega AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 21, 2026 Talk Malware & Reversing Ekoparty Miami 2026 Nelson Insaurralde AR Malware en tiempos de AI

  La inteligencia artificial está redefiniendo el panorama de la ciberseguridad. Lo que antes eran piezas de código estático y predecible hoy evoluciona hacia amenazas dinámicas capaces de adaptarse, mutar y tomar decisiones en tiempo real.

  En esta charla exploramos cómo los atacantes están incorporando modelos de AI para automatizar la generación de variantes, mejorar la evasión y acelerar el ciclo de ataque. A través de casos reales y una demo, se muestra cómo un agente controlado por IA puede cambiar su comportamiento en función del entorno y del resultado de sus propias acciones.

  El objetivo no es mostrar malware, sino evidenciar un cambio de paradigma: la detección basada en firmas y patrones está quedando atrás frente a amenazas que evolucionan en cada ejecución.

  La pregunta ya no es si esto va a pasar. La pregunta es: ¿estamos preparados para defendernos de algo que aprende?

  ResearchersNelson Insaurralde AR

  Presented at Ekoparty Miami 2026

  View official schedule
• May 6, 2026 Talk Malware & Reversing 8.8 UnReal Perú 2026 Manuel Flores PE Backdoor en tu bolsillo: CraxsRat y otros peligros en Android

  No description of the talk has been published by the event.

  ResearchersManuel Flores PE

  Presented at 8.8 UnReal Perú 2026