June 18.-19. 2026

Cloud CVEs are relatively rare, as most vendors avoid issuing them for vulnerabilities that require no customer action. In the Microsoft world, only critical cloud vulnerabilities receive one. This talk examines CVE-2025-55241, a CVSS 10.0 vulnerability in Microsoft Entra ID that could have been used to compromise any tenant. By abusing an undocumented backend token service and combining it with my favourite a legacy tenant management API, it was possible to request actor tokens that crossed tenant boundaries and impersonate arbitrary users, including Global Administrators. In practice, this enabled full takeover of any Entra ID tenant, with minimal logging and limited opportunities for detection. Rather than focusing solely on the exploit, this talk covers the story behind the research, and how many small pieces of over the years led up to the discovery of this vulnerability.



Bio:
Dirk-jan Mollema is a security researcher focusing on Active Directory and Microsoft Entra (Azure AD) security. In 2022 he started his own company, Outsider Security, where he performs penetration tests and reviews of enterprise networks and cloud environments. He blogs at dirkjanm.io, where he publishes his research, and shares updates on the many open source security tools he has written over the years. He presented previously at DEF CON, Black Hat, TROOPERS, BlueHat and many other conferences, is a current Microsoft MVP and has been awarded as one of Microsoft’s Most Valuable Researchers multiple times.

In this talk, Clemens Stockenreitner and Werner Schober of the SEC Consult Vulnerability Lab highlight several critical vulnerabilities found in dormakaba’s physical access control systems based on exos 9300. This access control system originates from the manufacturer's enterprise product line for door and access systems and is predominantly used by large enterprises in Europe, including industrial and service companies, logistics operators, energy providers, and airport operators. It controls access to public and restricted areas, typically in combination with key cards (RFID) or fingerprint readers. According to the manufacturer, several thousand customers were affected, a small proportion of whom operate in environments with high security requirements. These flaws let an attacker open arbitrary doors in numerous ways, reconfigure connected controllers and peripherals without prior authentication, and much more.



Bio:
Werner Schober
Principal Security Consultant Werner specializes in all aspects of IT infrastructure security. By day, he supports clients in strengthening the security of their networks, services, software, and appliances across both Windows and Unix environments. By night, he contributes to the SEC Consult Vulnerability Lab, where he focuses on identifying zero-day vulnerabilities across a wide range of products.



Bio:
Clemens Stockenreitner
After completing his university studies, Clemens joined the infrastructure security team at SEC Consult. His focus is on security assessments of Windows- and Unix-based systems as well as Active Directory. In this role, he supports companies with his infrastructure expertise in identifying and remediating vulnerabilities.

The DFIR Report is a well-known company and project in the Cyber Threat Intelligence and Incident Response community, thanks to its high-quality, detailed reports that provide technical insights into real-world intrusions. The high-level graphics, backed by technical deep dives, make the reports suitable for all cybersecurity audiences and provide actionable information that companies and defenders can use to protect their most valuable assets from threat actors, especially ransomware operators. The DFIR Report is bringing its reports to the stage. Moving beyond written articles and podcasts, our analysts will present a live dissection of recent, high-impact cases. This session will leverage our signature timeline graphics and technical deep dives to guide the audience through the full intrusion lifecycle. Attendees will gain unique insights into real-world attack patterns, along with concrete strategies for detection and remediation. At Area 41, the DFIR Report will present the following two incidents: Contagious Interview: An intrusion identified as part of the Contagious Interview campaign, an ongoing effort by North Korean state-sponsored threat actors to secure revenue streams supporting the DPRK regime's operations. During the attack, several npm packages were used to operate a command-and-control infrastructure. The modular, multi-stage toolset included OtterCookie, InvisibleFerret, and Tsunami installer, enabling initial access, interactive command execution, persistence, and payload delivery across multiple operating systems. GootLoader Returns: An intrusion carried out by a threat actor who gained initial access through a GootLoader SEO poisoning campaign. Subsequently, the attack involved Kerberoasting, the execution of Supper proxies, and an identified proxy DLL referred to as “MEOWBACKCONN”. The final stage involved cleanup efforts via log clearing, hiding of RDP artifacts, and manipulation of registry keys.



Bio:
Angelo Violetti - Senior DFIR Analyst @ Swisscom B2B CSIRT & The DFIR Report Threat Analyst Angelo is a senior digital forensics and incident response professional with over six years of experience. His technical skills primarily focus on ransomware threats, Azure/M365 investigations, and tracking adversary infrastructure. He spoke at different conferences like BTV Defcon 32, SANS Ransomware Summit 2025, Swiss Cyber Storm and actively contributes to The DFIR Report. Angelo holds multiple certifications: GCTI, GCFA, CRTO, and others in malware analysis and cloud security.



Bio:
Alessandro Di Carlo - Senior Product Manager @ ThreatDown & The DFIR Report Contributor Alessandro is a cybersecurity professional responsible for ThreatDown’s Detection & Response products portfolio. Alessandro has extensive experience in digital forensics, incident response and penetration testing, having held leadership roles across incident investigation, security operations, and offensive security programs. His background combines hands-on experience in cyber investigations with product and security leadership. Alessandro holds several industry certifications (GCFA, GASF, eCPPT, eWAPT, eCDFP) and has participated in advanced DFIR and security competitions organized by the SANS Institute.

The Volkswagen Group's MIB2 infotainment system, deployed across VW, Audi, Skoda, SEAT, Bentley, and Porsche, is far from obsolete. As of February 2026, over 50,000 MIB2 High-equipped vehicles are still registered and actively driven on Swiss roads alone. This talk chains together hardcoded credentials, weak access controls, plaintext data storage, and firewall misconfigurations, turning an initial compromise into a fully eavesdropped vehicle. Everything is demonstrated live on a real MIB2 unit on stage. The talk closes with a look at MIB3 and where automotive security is heading.


Bio:
Raphael Lipp
I am a cybersecurity student at HSLU Rotkreuz and work as a Cyber Security Consultant at Popp Schweiz AG. With a background as a Multimedia Electronics Technician, the passion for hardware never went away, it just found new targets. This talk is the result of combining that hands-on hardware instinct with a deep dive into automotive security research, driven by the question of what happens when nobody bothers to revisit older technology. Pascal Gujer is a good friend and hardware security expert who pulled me deeper into the world of automotive security and has been by my side throughout this research. Together we have collaborated on previous security work, including supporting his Black Hat 2024 training Defeating Microsoft BitLocker.

The DragonForce operation has transitioned from a RaaS model into a highly sophisticated cartel, as analyzed in a December 2025 case study on a US services company. After initial access and securing their foothold, the group's advanced defense evasion includes code execution via application hijacking and a multi-vector Bring Your Own Vulnerable Driver (BYOVD) strategy. This BYOVD approach exploits known vulnerabilities in legitimate vendor drivers from Tower of Fantasy and Topaz Antifraud, and introduces a novel "Havoc Process Terminator" leveraging a Huawei component for kernel-level security process termination. The signature tool is a new, Go-based remote access backdoor, a 'TURN' in C2 capability, inspired by GhostCall. It achieves stealth by using an anonymous token from a popular communication service to interact with a legitimate Microsoft relay server before establishing a direct, malicious QUIC C2 channel. The backdoor provides comprehensive control, including command execution, reconnaissance, and credential theft. This combination of cartel structure and advanced toolsets marks DragonForce as a major and persistent threat, necessitating active defense hunting for BYOVD exploitation and anomalous outbound TURN/QUIC communications.


Bio:
Thibaut is a Threat Researcher at Broadcom, for Symantec, in a team specialised in Threat Research. His job mainly consists in tracking APT groups and targeted ransomware actors. In the past, Thibaut worked for ESET Canada, where he presented about a Chinese APT group at BSides Montréal.

Almost all companies that run SAP also run add-ons. Yet practically none of them perform adequate security analysis of their third-party solutions. Lots of external code is running on their networks that has never been inspected for risks. This presentation is backed by analysis data from over 100 companies and a long list of critical vulnerabilities in add-ons, ranging from those of small vendors to market leaders, security solution providers, and 'Big 4' financial auditing companies. The talk explains why companies running SAP currently have a severe blind spot, and what could happen if ABAP-based malware were to infiltrate their SAP landscape, based on insights gained from several simulated malware infiltration projects involving major companies in Germany. Some of the details to be discussed are: - Common security defects in third-party solutions; - Backdoors in third-party solutions; - Good practices for dealing with security issues in third-party solutions. The talk will also explain the power of ABAP-based malware. - Potential ways to sneak into an SAP system - Techniques to further penetrate the SAP landscape that are not on your radar - Methods to gain and maintain control over an SAP system - The full damage potential against not only the SAP installation, but also IT and OT systems in the company network This talk demonstrates what could turn into an extinction-level event for a company.


Bio:
Andreas Wiegenstein is engaged in SAP cyber security since 2003. He discovered quite a number of zero-day vulnerabilities in SAP software and supported development of a market leading static code analysis tool for the business programming language ABAP. He has spoken at more than 70 conferences world-wide about SAP security, including Black Hat, DeepSec, Hack In The Box, IT Defense, RSA, SAP TechEd and Troopers (alphabetical order). His current research is focused on SAP malware and supply chain attacks.

Although EDRs are central to modern cyber security defence, their detection logic remains largely hidden. I developed EDR Introspection, a framework that uses PPL-level access, disables kernel callbacks, and uses reflective DLL injection to execute monitoring code inside an actual running EDR process, enabling novel and deep insights of the EDR's detection logic itself. This overview effectively enables visibility over static checks of the EDR, emulations and memory scans during runtime, which enables to observe bypasses live for a first time, from obfuscation, anti-emulation and anti-runtime tracking (deconditioning). Red and Purple Teamers can use this project to systematically develop and debug EDR Bypasses, to understand the actual detection, instead of relying on trial-and-error approaches. Attendees will gain insight into how modern EDRs actually function and behave when analysing malware, not just how vendors document them.



Bio:
Levi is a Incident Responder at Raiffeisen Schweiz and a recent MSE graduate at zhaw in CS, specializing in maldev and DFIR automation. A former Red Teamer and CTF developer and participant he holds the OSCP, GCFA, and GDAT, alongside a SANS 599 coin). Levi is a (founding) member of BBOC-CH and a (past) member of /mnt/ain. He balances his technical deep-dives into cryptography and AI with karate, chess, and independent coding projects.

Modern Linux Endpoint Detection and Response solutions are built on three fundamental pillars: syscall monitoring via kernel tracepoints, userland function hooking through library interposition, and static binary analysis of on-disk executables. In this talk, I systematically dismantle all three, achieving complete EDR blindness. I introduce a layered evasion methodology that chains three independent techniques into a single attack chain. First, I perform automated EDR reconnaissance: a hook detection tool walks the GOT/PLT of loaded libraries and compares in-memory function prologues against clean on-disk copies, identifying exactly which functions each EDR product instruments. Armed with this map, i deploy a custom ELF packer that achieves fileless in-memory execution via memfd_create and fexecve, with direct syscall stubs that bypass all userland hooks entirely. Finally, all post-execution is routed exclusively through the io_uring submission/completion ring interface, producing zero syscall traces visible to ptrace, seccomp-bpf audit, or kernel tracepoint-based monitors. Making a ransomware invisible.


Bio:
Massimo Bertocchi is a cybersecurity professional currently working in the Threat Detection and Hunting team at SIX Group in Zürich, Switzerland. He holds dual master's degrees in Security and Cloud Computing from two European institutions: KTH Royal Institute of Technology in Stockholm and Aalto University in Helsinki. His research interests include advanced persistent threats, covert channels, and endpoint security. He brings a unique combination of theoretical knowledge and practical industry experience to the evolving landscape of cybersecurity.

"The Aethra Chronicles" is a 1994 open-world RPG game that I greatly enjoyed as a kid, but never managed to finish. Around the New Year, with a bit more time on my hands, I finally decided to change that — and it took roughly 25–30 hours. And then I started thinking — can I "cheese" this game somehow and complete it faster? This said, I am not a speedrunner. But what I do have are a very particular set of skills. Skills I have acquired over a very long career. Skills that make me... What I'm trying to say is that I'm pretty good with software. Join me on a hacker-goes-speedrunning adventure: there be dragons, file formats, real-mode reverse-engineering, bugs in the game, and even some cryptography!


Bio:
An enthusiast programmer with a passion for computer security and low-level aspects of IT. Coldwind authored the bestselling "Zrozumiec Programowanie" ("To Understand Programming") book, co-authored the "Praktyczna Inzynieria Wsteczna" ("Reverse Engineering in Practice"), as well as numerous articles, publications, podcasts and lectures devoted to mentioned topics. He is the co-founder and former captain of Dragon Sector – historically one of the best competitive security teams in the world. He's also the creator of Paged Out! – an experimental technical magazine. Coldwind spent most of his 20-year professional career on Google's information security team. Currently he's a security researcher and managing director of HexArcana Cybersecurity GmbH.