VB2026 programme

Back to VB2026 conference page

Wednesday 14 October 2026

Time Green room Red room
 Small Talks
10:30 - 10:40

Conference opening session
(takes place in the Green room)
10:40 - 11:20 Opening keynote: Seeing through a straw: when the threat is bigger than your data Katie Nickels (Okta)
(takes place in the Green room)
  
11:25 - 11:55 I will find you and I will flag you: hunting malicious packages at scale Christophe Tafani-Dereeper & Julien Doutre (Datadog)  Gorbag: Orcs at the border Damien Schaeffer (ESET)  From dead malware to living adversaries: AI-powered digital twins for adaptive APT modelling Alexander Adamov (Blekinge Institute of Technology, NioGuard Security Lab) & Anders Carlsson (Blekinge Institute of Technology)
11:55 - 12:25 Snap, trigger, steal: SnappyClient and the art of trigger-based intrusions Muhammed Irfan V A, Avinash Kumar & Nirmal Singh (Zscaler)  The other side of the front: hunting Paper Werewolf's operations against Russia Nicole Fishbein (Intezer) 
12:25 - 14:00 Lunch 
14:00 - 14:30 Tracing the bloodline of LLM-driven polymorphic malware: do GHOSTs leave footprints? Chanbin Jeon, SeungBeom Lim & SuhMahn Hur (SANDS Lab) The invisible warzone: competing botnets fighting over your smart TV Asher Davila, Chris Navarrete & Doel Santos (Palo Alto Networks)   
14:30 - 15:00 The edge is the enemy: hunting Chinese router relay networks Ryan Sherstobitoff (Shadowgrid)  Spec-driven malware: turning markdown into threats Sven Rath (Check Point Research) 
15:00 - 15:30 Unravelling Lumma Stealer’s protection stack: pushing static deobfuscation to its practical limit Yuki Umemura (Kobe University)  Free games, costly consequences: unravelling PiviGames’ hidden treasure malware John Rey Dador (G DATA)   
15:30 - 16:00 Tea/Coffee 
16:00 - 16:30 Reverse engineering a multi-stage implant targeting Vietnamese organizations Minh Anh Luong (VNPT Cyber Immunity)  Operation RikiBox: the new threat actor with two novel persistence mechanisms Sojun Ryu (Kaspersky) Workshop: Collaborative attack modelling across CTI, Red Team, and SOC Mike Cunningham & Suneel Sundar (MITRE) 
16:30 - 17:00 Khmer Shadow: uncovering a targeted cyber espionage campaign against Cambodian military intelligence Subhajeet Singha (Acronis)  From exclusive to widespread: the shifting exploitation dynamics of (zero-day) vulnerabilities before and after their (public) disclosure Kerstin Zettl-Schabath & Kritika Roy (Deutsche Cyber-Sicherheitsorganisation (DCSO)) 
17:00 - 17:30 Break the silence: tracking Silent Lynx through exposed infrastructure Julian-Ferdinand Vögele (Recorded Future) & Chi En (Ashley) Shen (Cisco Talos) Gulp: exploring and overcoming the limits of modern DFIR (partner presentation) Gabriele Zuddas (Mentat)
17:30 - 18:30  Posters will be displayed throughout the day in the conference foyer, with a poster presentation session at the end of the day.
19:30 - 21:00 VB2026 drinks reception

Thursday 15 October 2026

Time Green room Red room
 Threat Intelligence Practitioners' Summit
09:00 - 09:30 Agent detection & response: safety on a token budget Václav Belák, Jakub Křoustek & Tomáš Ďuriš (Gen) How real-world malware disables EDR systems Holger Unterbrink (Cisco Talos) Keynote: The next chapter Jiří Sejtko (Gen)
09:30 - 10:00 Leveraging Landlock telemetry for Linux detection engineering Guillaume Couchard & Erwan Chevalier (Sekoia) Targeting the elderly: from spoofing to persistence Axelle Apvrille (Fortinet) Iberian deception: phishing campaigns targeting tax and traffic authorities in Portugal and Spain Natasha Márquez & Ghyorka Kpee (Group-IB)
10:00 - 10:30 Hidden in the overlay – analysis of a backdoor leveraging encrypted overlay communications for ORBs Yuma Masubuchi (JPCERT/CC) Disrupting the threat actor mythos: data-based insights into targeting, tooling, and the limits of AI in cybercrime Selena Larson & Daniel Blackford (Proofpoint) From signal to shield: rapid collaboration to defend critical infrastructure during crisis Madeline Sedgwick (Palo Alto Networks)
10:30 - 11:00 Tea/Coffee 
11:00 - 11:30 Threat intelligence-driven clustering: identifying a new cyber-mercenary intrusion set Maher Yamout & Fatih Şensoy (Kaspersky) Under the surface: inside the evolving 10FXRAT campaign Yoshihiro Ishikawa & Takuma Matsumoto (LAC)  Wartime intelligence collection and collaboration Sergey Shykevich (Check Point)
11:30 - 12:00 After the wipe: runtime root-secret recovery from JadePuffer/ENCFORGE on Windows Wei Gao (Intel) From hotel account compromise to guest payment fraud: the reservation hijack attack chain Luis Corrons & Jan Rubín (Gen)  Harmonizing AI agents and human analysts in CTI – are CTI agents friends or rivals to junior analysts? Takahiro Kakumaru (NEC) 
12:00 - 12:30 From seed to branch: inside DarkPlum's expansion to Ukraine Masaya Motoda, Shogo Hayashi & Rintaro Koike (NTT Security (Japan))   Malwaremorphosis – breaking down a global multi-layer malvertising operation Ionuț Baltariu (Bitdefender)  Stairway to resilience: cybersecurity in good times, bad times, and everything between Selena Larson (Proofpoint), Jeannette Jarvis (Cyber Threat Alliance), Kathi Whitbey (Palo Alto Networks) & Jeanette Miller-Osborn (Dataminr) 
12:30 - 14:00 Lunch 
14:00 - 14:30 Mac&Cheese: cooking up the DigitStealer recipe Kseniia Yamburh (MacPaw) & Joan Garcia (Independent researcher)  The cyber saga: deconstructing the DPRK’s global synthetic IT workforce ecosystem Anastasia Tikhonova (Group-IB)  STIX in action: proposed industry collaboration on sharing DigSig metadata Samir Mody (K7 Computing)  
14:30 - 15:00 Meet ARES – an agentic reverse engineer that decrypts sophisticated ransomware encrypted files Raviv Rachmiel & Yonatan Gilvarg (RIO Security) DPRK-aligned threat operations: tradecraft, tooling, and detection patterns Wonkyeom Kim  Defending (against) the human layer: IoBs in the real world Righard Zwienenberg (ESET), Kathi Whitbey (Palo Alto Networks), Samir Mody (K7 Computing) & Mienke (NCSC-NL) 
15:00 - 15:30 Paying the TOLL: how REF3927 turned 571 IIS servers into an SEO fraud network Salim Bitam & Jia Yu Chan (Elastic)  Operation ASTERIX: software developer by day, crypto scammer by night Anna Širokova & Jan Řečínský (Rapid7)  From strategic collections to global and multifaceted ransomware response Gonçalo Ribeiro (Europol - EC3) 
15:30 - 16:00 Tea/Coffee 
16:00 - 16:30 Manufactured credibility: detecting fabricated Git history in an active software supply chain campaign George Karagiannidis & Evangelos Ganiaris (TwelveSec)  Newsjacking the world: tracking three months of uncovered APT operations disguised as global headlines Darrel Tristan Virtusio & Subhajeet Singha (Acronis)  Ghosts in the chat: tracking GhostPairing from trusted message to linked-device takeover Michal Salat (Gen)
16:30 - 17:00

The invisible candidate: tracking the evolution of 'Un-tracked' GRITCASPIAN Asli Koksal (Google) 

 Dawn of Ninja Era: unmasking a malware distribution campaign linked to DPRK IT workers network Naoki Takayama (Internet Initiative Japan) The art of fighting back Gabor Szappanos (Sophos) 
17:00 - 18:00  Posters will be displayed throughout the day in the conference foyer, with a poster presentation session at the end of the day.
19:30 - 23:00 Pre-dinner drinks reception followed by VB2026 gala dinner & entertainment

Friday 16 October 2026

Time Green room Red room
 Small Talks
09:30 - 10:00 Kimwolf’s claws loom over 1.8 million firewalled Android devices worldwide Alex Turing (Qi-Anxin) AI in malware: evolution and predicting the future of AI-driven attacks Eli Smadja & Ben Herzog (Check Point) The silent threat in your enterprise: SAP security Anita Cwynar (Independent researcher)
10:00 - 10:30 Polling is the vulnerability: a case for event-driven cloud detection Santiago Abastante (dbnz)  Practical ransomware detection on macOS (via maths, not AI) Patrick Wardle (Objective-See Foundation) 
10:30 - 11:00 Tea/Coffee 
11:00 - 11:30 Defeating indirect branching obfuscations in malware with Hex-Rays Decompiler Georgy Kucherin (Kaspersky)  Ghost in the webmail: how TA488 learned to haunt your inbox Saher Naumaan (Proofpoint)  Notoriously reluctant: continuing conversations with FBI and private sector defenders about disrupting cybercriminals through collaboration Sara Eberle (Sara Eberle Consultin) & DeLynn Bettencourt Hammell (FBI) 
11:30 - 12:00 Operation FalseProof: PoC that bites back Jiho Kim, Minyeop Choi & Taeyun Jang (S2W)  Hunting LANDFALL: from overlooked images to state-linked mobile spyware Itay Cohen (Palo Alto Networks' Unit 42) 
12:00 - 12:30 Inside a Sandworm attack: UAC-0099 access and a Yggdrasil-backed backdoor Anton Cherepanov & Peter Strýček (ESET)   Inside Popa: a day in the life of a residential proxy Carel Bitter (Spamhaus Technology)  BEAST: binary emulation and analysis simulation technology for advanced malware analysis and anti-forensic countermeasuresBramwell Brizendine, William Lochte,Alexander Wood & Jared Sheldon (University of Alabama in Huntsville)  
12:30 - 14:00 Lunch 
14:00 - 14:30 Otter encyclopedia: deep analysis of Otter family Rintaro Koike, Yuta Sawabe & Masaya Motoda (NTT Security (Japan))  Transparency wars: exposing hidden biases in testing Righard Zwienenberg (ESET) & Luis Corrons (Gen)   
14:30 - 15:00 Discerning the invisible: a heuristic engine for behavioural inference in nation-state covert networks Madeline Sedgwick (Palo Alto Networks)  When malware talks back: real-time interaction with a threat actor during the analysis of Kiss Loader Marvin Castillo & Arvin Jay Bandong (G DATA)  *Reserve paper: 
When wipers leave backups: an analysis of ArgonWiper’s encryption workflow Hyuna Lee & Hyoje Jo (SK Shieldus)
15:00 - 15:30 Tea/Coffee 
15:30 - 16:10 Closing keynote: Setting off into the wild blue yonder Saâd Kadhi (CERT-EU)
(takes place in the Green room)
16:10 - 16:20 Conference closing session  
(takes place in the Green room)
16:20 - 17:20  Posters will be displayed throughout the day in the conference foyer, with a poster presentation session at the end of the day.

Reserve paper

*Should this paper not be required to replace papers on the main programme, it will be presented in the Small Talks room on Friday 16 October at 14:30.

Back to VB2026 conference page

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.