CYBERWARCON 2018
2018-11-28
Arlington, United States
[CYBERWARCON 2018, CYBERWARCON 2019, CYBERWARCON 2021, CYBERWARCON 2022, CYBERWARCON 2025]
who it's for
threat intelligence analysts, incident responders, security researchers, network defenders, critical infrastructure operators, policy makers, higher education administrators
topics
GreyEnergy backdoor framework; node-overlap detection for leaks; KillDisk-style wiper malware; stolen code-signing certificates; WHOIS timestamp clustering; Instagram-focused influence campaigns; TEMP.Isotope (Dragonfly 2.0) probes; spearphishing and watering-hole tactics; Netsweeper-based national censorship routing; underground cybercrime market pricing; ME Doc software update abuse; domain and hosting collocation analysis
| title | author | length |
|---|---|---|
| Infosec 1930 - CYBERWARCON Keynote | Thomas Rid | 19m |
Claims that a 1930 “Comintern” letter naming 30 agents as Soviet instigators is a genuine Soviet operation are wrong: primary-source forensics trace the… | ||
| "False Leaks" - A Network Lens on Cyber-Enabled Information Operations | Camille Francois | 32m |
Maps social media dissemination around high-profile “false leaks” (DNC, Podesta, doping, French election files), separating the three phases: compromise… | ||
| GreyEnergy: Beyond BlackEnergy and NotPetya | Robert Lipovsky, Anton Cherepanov | 23m |
GreyEnergy is a stealthy backdoor framework tied to BlackEnergy and TeleBots that targets the energy sector in Ukraine and Poland, with seven confirmed targets… | ||
| Revisiting Known Perps: Behavioral Profiling for Continuous Monitoring of Threat Actors | Juan Andrés Guerrero-Saade | 27m |
Argues for profiling based on observable tooling and operations rather than institutional labels, showing how to infer resource model (internal dev vs… | ||
| An Analysis of Micro and Macro Cyber Attacks in the Ongoing War in Yemen | Allan Liska, Winnona DeSombre, Greg Lesnewich | 29m |
Yemen net controls most national routing and after seizing Sana routes traffic and censors via Netsweeper while Aden/Adennet routes out through Saudi pipes… | ||
| Iran's Decade of Soft War: Dissidents, Trolls, and Khamenei | Simin Kargar | 08m |
Claims that Iran runs coordinated Persian‑language influence campaigns backed by partial state endorsement, with heavy automation + state endorsement signals… | ||
| Bears in the Lines: Russian Critical Infrastructure Espionage in the Face of US Grid Resilience | Alex Orleans | 19m |
Claim: a Russian-nexus espionage group TEMP.Isotope (Dragonfly 2.0, Berserk Bear) has been probing U.S. electricity since ~2015 using spearphishing and… | ||
| Unrestricted Warfare on Campus: Chinese Information Operations and American Higher Education | Lauren Cooper | 24m |
Claims that China runs coordinated information operations against US universities to harvest IP and influence policy, using Confucius Institutes (100+ in the… | ||
| Barely Whispering | Kurt Baumgartner | 08m |
Argues that Sofacy, Zebrocy, BlackEnergy and a Hades cluster are transitively linked based on concrete overlaps: shared infrastructure and IPs, reuse of… | ||
| Behind the Next Destructive Attack | Adam Meyers | 10m |
Tracks a single campaign that evolves from power-outage attacks in Ukraine (BlackEnergy/VoodooBear) through abuse of the ME Doc update channel, tests like… | ||
| Outsourcing Cyberwar | Kimberly Goody, Cristiana Brafman Kittner | 11m |
Analysis of underground markets shows ready-built offensive capabilities and concrete prices: network access sells for $36,000 (financial) down to <$2,000… | ||
| Influencer Vaccine: Identifying Information Operations Infrastructure | Kyle Ehmke | 31m |
Case study shows cybersecurity techniques linking domain registration and hosting data to influence infrastructure: a registrant (records name and Yandex… | ||
| Disinformation or Debate? Finding Signal Amid Political Noise | Olga Belogolova, Madelyn Wilson | 35m |
Facebook’s Community Threat Intelligence team outlines concrete methods: focus on coordinated inauthentic behavior (coordination + misleading identity), use… | ||
| Are US Cyber Deterrence Operations Suppressing or Inciting Attacks? | Jason Healey, Neil Jenkins | 32m |
Argues the US now uses offensive cyber operations to impose friction for deterrence and offers a repeatable framework to assess whether that reduces or… | ||
| nothing matches | ||