1:30 pm

Registration

2:00 pm

Welcome & short introduction from Mark Beerends, SIGS Contributor & Cyber Strategy Partner at Prusec GmbH

2:00 pm

Patrick Lodder, Global Head of Threat Intelligence Services at NVISO Security

VSHELL - Tracking a State actor used Modern Post-Exploitation Framework in the Wild
VShell is a post-exploitation command and control framework that has increasingly appeared in real world intrusions targeting government and critical sectors. Following NVISO’s initial research and publication, we continued tracking VShell infrastructure globally to better understand how the framework is deployed and operated by threat actors.

This presentation provides a short overview of how VShell works and why it is attractive for adversaries. We will then focus on what happened after disclosure: how VShell infrastructure can still be fingerprinted today, how tracking methods have evolved, and what we have observed in the wild over the past year.

Using practical examples from real world tracking, we demonstrate how network fingerprints, infrastructure patterns, and traffic analysis still allow defenders and investigators to monitor VShell deployments and identify potential victims. The session will also reflect on the broader question of whether public threat research actually changes attacker behaviour, or whether many detection and tracking opportunities remain effective long after publication.

2:30 pm

Keynote

(details will follow)

3:00 pm

Short presentation from a sponsor

3:10 pm

Short presentation from a sponsor

3:20 pm

Break

4:00 pm

4 different Breakout Sessions to join - you can choose/attend two of them

Breakout Session 1: (details will follow)

Breakout Session 2: (details will follow)

Breakout Session 3: (details will follow)

Breakout Session 4: (details will follow)

5:10 pm

Short break and change the room to the next Breakout Session of your choice

5:20 pm

Start of the second Breakout Session round

6:30 pm

Dinner & Networking till open end

Patrick Lodder
Global Head of Threat Intelligence Services at NVISO