CYBERWARCON 2019
2019-11-21
Arlington, United States
[CYBERWARCON 2018, CYBERWARCON 2019, CYBERWARCON 2021, CYBERWARCON 2022, CYBERWARCON 2025]
who it's for
threat intelligence analysts, security researchers, information operations specialists, incident responders and forensic investigators, critical infrastructure operators, security operations center analysts, policy and regulatory advisers
topics
Sandworm destructive toolkit; supply chain compromise via Medoc; mobile backdoors with Wi-Fi exfiltration; PowerShell Empire via Office macros; credential-phishing waterholes; domain and registrant attribution; influence campaign topic modeling; commercial disinformation for hire; CHOLLIMA DPRK cyber ecosystem; red-sourcing and commodity tooling; ICS attacks and telephone DDoS; APT29 Operation Ghost techniques
| title | author | length |
|---|---|---|
| Keynote - Andy Greenberg's Reflections on Sandworm | Andy Greenberg | 32m |
Chronicles how Sandworm escalates from a phantom mouse attack that remotely flips circuit breakers to a toolkit of rewritten firmware, kill‑disks, telephone… | ||
| The Secret Life of Sandworms | Neel Mehta, Billy Leonard | 26m |
Newly uncovered campaigns attribute a cluster of operations to Sandworm that go beyond destructive ramps and election leaks: targeted compromises of Ukrainian… | ||
| Internal Influence: A Sampling of Domestic Information Operations | Kyle Ehmke | 10m |
Domain research shows 13 Facebook pages amplify Daily Wire posts over 300 times per week on average and generate ~1.2 million engagements in September 2019, a… | ||
| China’s Influence Campaign Targeting the Hong Kong Protests: What the Data... | Lee Foster, Ryan Serabian | 25m |
FireEye tracks the campaign from June and supplements Twitter’s public takedowns (about 14 million tweets) with 2.5 million additional tweets collected… | ||
| Lord of the Flies: An Open-Source Investigation into Saud al-Qahtani | Nathan Paul Tannen | 23m |
Investigation links a Gmail, a royal-court email and a phone number to a verified Twitter account, ties the Nokia-team Hack Forums account to that Gmail, and… | ||
| Your Persistent Friend: The Untold History of Iran’s Effectiveness in Using... | Camille Francois, Madelyn Wilson | 20m |
Tracing operations back to 2011 reveals Iran running long‑lived, high‑volume IO that moves from malware delivery to large‑scale media-like networks. Campaigns… | ||
| The Disinformation Industry | Cindy Otis | 24m |
Describes a growing commercial ecosystem that sells coordinated falsified influence: researchers link a US company (Bivona Digital/LaCorte) and a… | ||
| Ch-Ch-Changes: The Arc of the CHOLLIMA’s and DPRK’s State-Driven Cyber Ecosystem | Katie Blankenship | 09m |
Since 2015 five CHOLLIMA-aligned adversaries (Silent, Velvet, Ricochet, Stardust, Labyrinth) diversify missions, develop distinct toolsets and mix espionage… | ||
| RedSourcing: Cyberwar On a Budget | Chris Glyer, Nick Carr | 10m |
Claim: nation-state espionage increasingly majority of adversary toolkits are redsourced, letting low‑budget actors match older capabilities. Evidence… | ||
| Full-Spectrum Information Ops for Critical Infrastructure Attacks & Disruption | Joe Slowik | 21m |
Argument: attackers amplify cyber effects by layering other information‑operations methods—electronic warfare, military deception, influence campaigns—so a… | ||
| Operation Ghost: The Dukes aren’t back - they never left! | Matthieu Faou, Thomas Dupuy | 28m |
High-confidence linkage of long-running APT29 activity from 2013 through June 2019, named Operation Ghost, shows previously unseen tools plus reuse of miniDuke… | ||
| nothing matches | ||