1:30 pm

Registration

2:00 pm

Welcome & short introduction from Mark Beerends, SIGS Contributor & Cyber Strategy Partner at Prusec GmbH

2:00 pm

Patrick Lodder, Global Head of Threat Intelligence Services at NVISO Security

VSHELL - Tracking a State actor used Modern Post-Exploitation Framework in the Wild
VShell is a post-exploitation command and control framework that has increasingly appeared in real world intrusions targeting government and critical sectors. Following NVISO’s initial research and publication, we continued tracking VShell infrastructure globally to better understand how the framework is deployed and operated by threat actors.

This presentation provides a short overview of how VShell works and why it is attractive for adversaries. We will then focus on what happened after disclosure: how VShell infrastructure can still be fingerprinted today, how tracking methods have evolved, and what we have observed in the wild over the past year.

Using practical examples from real world tracking, we demonstrate how network fingerprints, infrastructure patterns, and traffic analysis still allow defenders and investigators to monitor VShell deployments and identify potential victims. The session will also reflect on the broader question of whether public threat research actually changes attacker behaviour, or whether many detection and tracking opportunities remain effective long after publication.

2:30 pm

Alexandru Stamate, DFIR Consulting Team Lead at AlexSta Cybersecurity AG

(details will follow)

3:30 pm

Short presentation from Filigran

3:40 pm

Break

4:15 pm

4 different Breakout Sessions to join - you can choose/attend two of them

Breakout Session 1: Filigran (details will follow)

Breakout Session 2: Markus Riegler, Senior Executive - Cyber Threat Intelligence at IKARUS Security Software GmbH

From Report to Detection: Using LLMs to Transform Cyber Threat Intelligence into Actionable Detection Rules
Cyber Threat Intelligence (CTI) reports contain valuable information about adversary tactics, techniques, and indicators, but much of this knowledge remains underutilized due to the manual effort required to translate narrative reports into actionable detection logic. Security teams must interpret text-heavy reports, extract relevant indicators and behaviors, map them to frameworks such as MITRE ATT&CK, and manually implement detection rules for platforms like Sigma rule format, YARA, or SIEM queries.

Breakout Session 3: (details will follow)

Breakout Session 4: (details will follow)

5:20 pm

Short break and change the room to the next Breakout Session of your choice

5:30 pm

Start of the second Breakout Session round

6:30 pm

Dinner & Networking till open end

Patrick Lodder
Global Head of Threat Intelligence Services at NVISO

Markus Riegler
Senior Executive - Cyber Threat Intelligence at IKARUS Security Software GmbH