Speakers

Bryson is the Founder of SCYTHE, a VC-backed start-up building a next generation threat emulation platform, and GRIMM, an offensive cybersecurity consultancy, and Co-Founder of the ICS Village, a non-profit in critical infrastructure security. He serves on the Board of Cyber Science at West Point; as a Senior Fellow at the National Security Institute and Senior Policy Advisor for Institute of Security and Technology. A U.S. Army Officer, he served in support of Operation Iraqi Freedom before leaving the Army as a Captain. He was recognized as one of the Top 50 in Cyber by Business Insider, Security Executive Finalist of the Year by SC Media, Tech Titan in Washington DC multiple times, SANS Institute and SINET16 Innovator of the Year, and Industrial Cyber Hall of Fame.

Hospitals are a perfect example of a complex System of Systems. Their infrastructure is like a small city, with multiple, independent, operationally distinct systems that interact to deliver healthcare services to users at the end of the day. No single system controls the whole, instead, clinical services emerge from the coordinated behavior of clinical, administrative, and logistical subsystems. This also mean multiple single points of failure. And the convergence of IT and OT in this small cities we call hospitals is ramping up their cascading risk profiles. In this talk, we will explore 1000 ways do die, from delayed surgeries caused by a ransomware attack on the scheduling software to patient evacuation from HVAC systems, from infusion pumps being manipulated to target kills to medical data exfiltration to some country in Asia, from backup generator damage to DICOM clinical image manipulation. We will marathon through many different scenarios, protocols and technologies, highlights as much as possible about the challenges hospitals face in this world where everything seems connected, online and at the reach of a button.

Pedro Umbelino holds the position of Principal Research Scientist at Bitsight and co-chairs the FIRST Time Security SIG. ⁤His eclectic curiosity has led to the uncovering of vulnerabilities spanning a variety of technologies, highlighting critical issues in multiple devices and software, ranging from your everyday smartphone to household smart vacuums, from the intricacies of HTTP servers to the nuances of NFC radio frequencies, from vehicle GPS trackers to blowing up gas stations ATGs. Pedro is committed to advancing cybersecurity knowledge and somehow help fixing Y2K38. He has shared his findings at prominent conferences, including Bsides Lisbon, BruCON, Critical Effect, DEFCON, FIRST, Hack.lu, RSAC or Underground Economy.

Everyone is hardening their AI. Prompt filtering, OWASP LLM guidance, jailbreak prevention — organizations are checking every box. This talk is not about any of that.

This is the true story of a security assessment where the AI held up fine and the cloud infrastructure collapsed completely. The story is real. The engagement was real. The AWS keys in the Terraform file were real. The DNS poisoning was real. The privileged Kubernetes pod was real. The four days of undetected access were real. The Poptart stories injected into the AI training corpus were also real — and that detail stays in the talk, because it is the moment the audience truly understands what unmonitored infrastructure access means in an AI environment. Not as a theoretical risk. As something that happened, was demonstrable, and went completely unnoticed.

This session delivers a full chronological walkthrough of attacker methodology, escalation chain, and cloud compromise against a production AI system — with technical honesty and structured so that both the humor and the horror land exactly where they should. The technical content covers OSINT methodology, credential exposure via IaC, cloud infrastructure enumeration, DNS cache poisoning for prompt interception, Kubernetes privilege escalation, and training data integrity — without ever touching the LLM directly.

Key takeaways:

• Securing the AI layer means nothing if the surrounding cloud infrastructure is neglected
• Exposed credentials in IaC files remain one of the most prevalent and preventable attack vectors
• Logging and monitoring are not optional — you cannot detect or respond to what you never captured
• Kubernetes RBAC and pod security are not defaults; they are decisions someone has to make deliberately
• Training pipeline integrity is an AI security control almost nobody is implementing
• A real attacker will always take the path of least resistance — and that path is rarely through your guardrails

The through line is simple and deliberately uncomfortable: the AI was the most secure part of the entire system.

Porto-based and powered by chaos, I split my time between Portugal, Chicago, and wherever the next conference or suspicious packet capture happens to be. Equal parts cybersecurity architect, honeypot wrangler, and frequent flyer with a questionable relationship to gravity, I run a growing Honeypot Empire designed to annoy attackers around the globe!!

When not speaking at security conferences or building deceptive little digital trapdoors for internet goblins, I can usually be found hopping continents, mentoring folks in cybersecurity, sipping dangerously good tequila, or voluntarily jumping out of perfectly functional airplanes. Sasha the Dancing Flamingo still supervises operations with chaotic authority and absolutely believes she deserves root access.

Thermal residue attacks - recovering PINs and passwords from heat left behind on keypads have long been considered an esoteric threat due to the high cost of thermal imaging equipment. This talk proves that effective thermal attacks no longer require $200+ smartphone attachments or thousand-dollar FLIR units.

Using a $30 far-infrared thermal array (such as the 32x24 pixel MLX90640) hooked up to a Raspberry Pi Zero via I2C, we demonstrate how to capture, process, and analyze keypress heat signatures in real time. We will walk through:

• AI Super-Resolution: A lightweight Convolutional Autoencoder upscales low-density 32x24 thermal matrices into high-fidelity temperature maps, isolating key boundaries.

• Temporal Heat-Decay Classification: A Recurrent Neural Network (LSTM / 1D-CNN) analyzes heat dissipation across consecutive frames, converting cooling rates directly into keypress chronology (e.g., Button 4 pressed 2s ago, Button 9 pressed 8s ago).

• Autonomous Edge Inference: The entire model is quantized to TensorFlow Lite / ONNX Runtime, running locally on $30 sensor rigs without needing cloud GPU processing or internet access.

• Field Results & Countermeasures: Benchmarking model confidence across door materials (ABS vs. Metal vs. Glass) and detailing how tiny heat perturbations can defeat the AI model.

Take Aways:

• Complete Bill of Materials (BOM) and schematics to build a low-cost thermal attack device.
• Open-source Python code for real-time sensor upsampling and temporal sequence recovery.
• Empirical attack data showing time-to-decay across common door lock materials.

Karim Zidani (Hacktivity.eu) Expert in Offensive Cyber Security

Karim Zidani is an offensive security specialist based in Rotterdam. He founded Hacktivity, a boutique red teaming consultancy working with Dutch financial institutions under TIBER-EU and DORA, and builds Exceed Cyber Security, an AI-driven external attack surface platform. His background is adversary simulation and exploit development: red team and pentest work at Shell, Rabobank, ING, DLL Group and CGI, contributions to DNB’s TIBER-NL framework, published CVEs, and the full Offensive Security certification track including OSEE. He also builds and ships privacy-focused networking hardware. He is interested in where automation actually replaces operator judgment in offensive work, and where it very much does not.

Large language models can already use shells, call security tools, inspect outputs and keep working on a target across many steps. Once planning, memory, reflection and tool orchestration are added, the resulting system starts to resemble an autonomous offensive operator. The problem is that we still have a poor idea of how much of that capability is real. Most public benchmarks compare complete systems, changing the model, controller, tools and execution budget at the same time. That makes rankings easy to produce and much harder to interpret.

We built a large controlled benchmark to measure offensive AI under a common execution contract. The campaign covers 60 models, 400 cybersecurity scenarios and more than 300,000 isolated executions, spanning frontier models, reasoning-oriented systems, coding models and open-weight families from multiple providers. Models were tested with different agent architectures while keeping tools, information, target conditions and resource limits comparable. Success was validated externally by the environment rather than by trusting the model’s own assessment.

The dataset lets us look at much more than final solve rate. We analysed multi-step progression, tool use, recovery after failed approaches, behaviour under resource pressure, generalisation across target variants, cost, latency and model-controller compatibility. Some agents burn through large amounts of compute while making almost no useful progress; others solve the same class of problem with surprisingly little structure around the base model.

We will present the benchmark design, the methodology used to keep the experiment reproducible, representative execution traces and the results across models, architectures and task families. The goal is to put numbers behind a question that is becoming increasingly relevant for defenders: how capable are autonomous offensive agents today, where do they still fail, and which parts of the stack are actually driving progress?

Pau Muñoz Pairet is a researcher and entrepreneur working at the intersection of artificial intelligence, cybersecurity and strategic studies. He holds a PhD in Strategic Studies from the University of Salamanca and a PhD in Artificial Intelligence from the Autonomous University of Madrid, where his research focused on information dynamics, recommendation systems, disinformation and cyber-warfare.

He is the founder and CEO of LOBERA.ai, a Spanish R&D company developing AI-based cyber defence and intelligence capabilities for security, defence and critical infrastructure environments. His work includes the direction of research and engineering projects in cyber intelligence, offensive and defensive cyber operations, and applied AI for organisations including the Spanish Joint Cyberspace Command.

Arbitrary file write is often treated as an “almost critical” bug class in web security: interesting and dangerous, but hard to prove impact when you can’t drop a web shell in an obvious location.

In this talk, we present a novel methodology that will let you pop shells across the most popular languages and frameworks in different ecosystems, all with minimal information about the application - which is particularly useful for bug bounty engagements.

We start by assessing the state of the art of arbitrary file write in black box scenarios, then build a methodology to identify exploitation capabilities and gather as much target information as possible. From there, we showcase new techniques to abuse file write primitives and achieve code execution, covering the most popular runtime environments.

The audience will leave with fresh techniques and a reusable mental model for identifying their target’s execution context and proving maximum impact in arbitrary file write scenarios.

Bruno Mendes is the Head of Hacking at Ethiack. He began his work career as an Offensive Security Researcher on Intel’s IPAS Cloud Security team in 2024.

In bug bounty, back in 2023 placed 5th overall in the teams category and won the “Not Dead Yet” award at an Intigriti Live Hacking Event in Lisbon, and most recently co-authored a critical RCE with André Baptista (0xacb) that earned over $100k+ in a single program.

He has an extensive CTF background being a three-time winner of the Cybersecurity Challenge Portugal (2021-2023), captain of Team Portugal at the European Cybersecurity Challenge (2022, 2023, 2025), and won the 2023 International Cybersecurity Challenge with Team Europe. He also captained the Instituto Superior Técnico CTF team (STT) from 2022 to 2024.

Security Researcher at Ethiack

Every year, conference badges end up forgotten in a desk drawer the moment the event ends, certainly accompanied by a mental note: “I’ll play with it ASAP.” But beneath the blinking LEDs and flashy screens lies a highly capable hardware platform. This talk is a call to action: don’t let your badge collect dust. Instead, reverse it, flash it, and retool it.

We will walk through the journey of taking the previous Bsides conference badge, powered by the ESP32-C6, reverse-engineering its hardware quirks, and repurposing it from scratch into a fully functional “Threat Radar” tool. Starting from a black-box approach with zero documentation, I will detail how we mapped the pinouts using visual tracing and brute-force test code, fought screen entropy to find the right display drivers, and bypassed strict hardware power constraints. And finally cover how we eventually leveraged existing baseline code to unlock the true potential of the C6 chip.

Attendees will learn about the badge’s architecture and how we built a custom threat-hunting app capable of continuous background scanning and Wi-Fi promiscuous sniffing. We will explore exactly how to build RF signatures by parsing payloads to detect Red Team tools, covert wearables (smart glasses), trackers (AirTags), and surveillance networks (Flock ALPRs). Finally, we will demonstratethe Foxhunt mode to physically track down MAC addresses in real-time. By the end of the talk, you will have the blueprint, and hopefully the motivation, to plug in your badge and build something completely new.

Adriano Moraes is a Senior Security Analyst and Android Reverse Engineer currently working at Google Play Protect. With a strong focus on malware analysis, exploit development, and defeating advanced compiler-level obfuscation, he specializes in building automated detection pipelines to handle native Android threats at scale. Based in Lisbon, Adriano’s research bridges the gap between traditional reverse engineering and modern data-driven analysis techniques.

A sophisticated Android TV-box botnet, spoofing devices as phones operated quietly, escaping public research for years. Now, its operators openly advertise it as a fleet of over 120,000 “AI digital humans”. This talk presents the first end-to-end dissection of the “Fuyao Enterprise,” an enterprise-level ad-fraud scheme.

Fuyao’s bots run a dual monetization: they click ads across a network of AI-generated content farms mimicking human browsing, or get resold as residential proxies. A web of shell entities collects the payout, quietly seeking to bypass modern anti-bot controls to generate millions a year.

This talk presents a teardown of Fuyao’s “fraud-as-a-product” architecture, including novelties such as dynamic fraud tasks using a custom drag-and-drop editor based on Blockly (a coding language designed for children), computer vision models and more. Finally, we will TRACE the money, map Fuyao’s web of shell entities, and trail it back to its corporate origins in mainland China.

Attendees will leave with a clear picture of what enterprise-grade ad-fraud looks like, how this grey market operates and how we traced, exactly who is behind it.

Pedro Falé is a Threat Researcher at Bitsight, he’s current role revolves around tracking botnets, researching infrastructure and malware. He has also worked with several incident response teams (CSIRT). He mostly enjoys studying novelty edge-cases / ecosystems

This session will examine GNSS jamming and spoofing as cyber-physical threats affecting systems that depend on trusted positioning, navigation, and timing data. While GNSS interference is often discussed as an aviation, RF, or military problem, this talk will reframe it as a cybersecurity issue for autonomous systems, critical infrastructure, logistics, maritime operations, drones, telecoms, and other timing-dependent environments.

The session will begin with a short technical primer on GNSS, explaining how jamming degrades signal availability and how spoofing manipulates receiver trust by injecting false positioning or timing data. I will then place these techniques in the context of hybrid warfare, showing how electromagnetic interference can create disruption, ambiguity, and strategic pressure without requiring a conventional network intrusion.

The core of the talk will walk through real-world European cases from 2015–2025, including incidents affecting the Baltic region, the Black Sea, Eastern Europe, northern Europe, and commercial aviation routes. These examples will be used to show how GNSS manipulation can move from local signal interference to broader operational risk.

The technical section will focus on detection and resilience. I will explain how defenders can test whether systems are blindly trusting GNSS data, and how spoofing can be detected when GNSS-derived positions diverge from expected movement or independent sensor inputs. Techniques discussed will include multi-constellation and multi-frequency comparison, Galileo OSNMA, inertial navigation systems, sensor fusion, route and velocity consistency checks, anomaly detection, and Kalman filter innovation monitoring.

Cybersecurity Solutions Architect Lead with experience in cybersecurity architecture, data security, privacy, compliance, and threat intelligence. She is also a cybersecurity researcher with the Space Generation Advisory Council’s Space and Cyber Security Project Group, focusing on cybersecurity, space systems, hybrid warfare, and critical infrastructure resilience. She has presented research at NATO MESAS on GNSS spoofing campaigns targeting autonomous systems in Europe.

We’ve moved past the era of users manually bypassing chatbot filters with ‘Ignore previous instructions.’ and entered a more dangerous era: Indirect Injection.

The 2025 EchoLeak exploit first proved that a single unread email could trigger Microsoft Copilot to silently exfiltrate private data without a single user click. This was followed by the 2026 Claude Code hijacks, which demonstrated that a poisoned .CLAUDE.md file in a repository could allow an attacker to execute arbitrary shell commands and harvest sensitive environment variables.

The fundamental lack of a security boundary between data and instructions causes LLMs to treat every input as a potential command, transforming seemingly benign files such as a CV or a RAG chunk into an injection vector that can force the model to ignore its safety boundaries.

This session deconstructs real-world injection attack examples and the obfuscation techniques that make them effective. You’ll see how attackers leverage hidden metadata, Unicode steganography, and homoglyph substitution to tunnel malicious instructions through ‘invisible’ channels.

We conclude by outlining a hardened design pattern for resilient LLMs to ensure your agents can process untrusted data without compromising their internal logic.

Michael is a Product Security Specialist at SAP, working with the SAP Cloud Infrastructure security team. His focus areas include vulnerability management, secrets management, and building secure internal services. He obtained multiple industry certifications such as OSCP, GCPN, and CISSP. Beyond his day-to-day work, Michael is an active member of the cybersecurity community and helps organize BSides Luxembourg.

Rafael Brinhosa: Information Security Leader, Architect, and Researcher with 20+ years of experience, with a strong focus on Application Security, Product Security, and AI/Agent Security. I build pragmatic security programs, assessments, and frameworks aligned to risk, governance, and engineering velocity. Hands-on across manual and automated security testing, Pentesting, DevSecOps, SAST, DAST, SCA, and the occasional bug bounty (once a year, in free time).

🏆 Ex-DELL, Ex-U.S. Bank, Ex-EDS (HP), Ex-Avaya, Ex-Volkswagen Digital Solutions (MAN Trucks and Buses). Currently Director of Information Security at Reltio (SAP company), leading Product Security, AppSec, and AI/Agent Security for a B2B SaaS data unification and context intelligence platform.

🎤 Speaker at OWASP Lisbon on AI agent security (“Hack Your Agents Before They Hack You”). 🔨 APIDetector presented at BlackHat Arsenal 2024.

During the 2025 Mobile Pwn2Own competition, we identified a series of vulnerabilities affecting Samsung devices. Chained together, these issues resulted in remote system-level compromise triggered by a single user interaction.

What distinguishes this entry from previous submissions is its focus on design oversights in Samsung’s voice agent, Bixby, that enabled privilege escalation through a single auto-granted Android permission. Because this permission is implicitly approved in many Samsung applications, exploiting just one of them allowed us to issue unauthorized commands to Bixby.

Further analysis revealed that Bixby maintains interprocess communication channels with a wide range of applications, including system components. We leveraged this architecture to force the agent to relay arbitrary commands to privileged services, effectively turning it into a bridge between unprivileged and system domains.

This briefing presents an architectural and security analysis of the Bixby voice framework and highlights the systemic weaknesses that enabled end-to-end device compromise. Specifically, we demonstrate how chaining vulnerabilities in preinstalled applications allowed us to leverage the Bixby agent to exfiltrate sensitive data and silently install applications by abusing its system-level capabilities.

Dimitrios is a Senior Security Researcher specializing in mobile and platform security, with deep expertise in Android internals, reverse engineering, and exploit development. As part of Microsoft’s Threat Intelligence organization, he conducts large-scale vulnerability research and malware analysis across mobile and cross-platform ecosystems.

He has been credited with numerous CVEs across major vendors including Microsoft, Google, Samsung, Zoom, TikTok, Xiaomi, and others, consistently uncovering high-impact flaws in widely deployed software. His work focuses on breaking trust boundaries and turning small logic bugs into full exploit chains. At Pwn2Own Mobile, he used that same approach to compromise a Samsung flagship device on production firmware.

Dimitrios builds offensive security tooling and has been active in reverse engineering communities since early in his career. A frequent speaker at Black Hat, Nullcon, Insomni’hack, Troopers, and Hack.lu, he is recognized for deeply technical research that connects vulnerability discovery with practical, real-world exploitation.

Ken Gannon, also known as Yogehi, is a mobile security researcher who spends most of his time breaking Android apps and the assumptions developers didn’t realize they were making. His work focuses on vulnerability discovery, exploit development, and chaining seemingly minor bugs into real-world compromises, with particular interest in WebViews, deep links, and the messy trust boundaries between mobile components. Ken has been repeatedly credited by Samsung Mobile Security for vulnerability reports across multiple release cycles and is listed in Samsung’s Rewards Program Hall of Fame. He is a three-time Pwn2Own Mobile Phones category winner (2023–2025), where he demonstrated multi-bug exploit chains against flagship devices by turning small, independent issues into full end-to-end exploitation paths.

Outside of competitions, Ken publishes technical writeups, tooling, and research notes through his personal site and GitHub, aiming to make practical exploitation knowledge accessible to other researchers. When he’s not reversing apps or debugging exploit chains at unreasonable hours, he’s usually gaming, digging through new attack surfaces, or building tools that probably started as “quick scripts” and grew out of control.

Data poisoning attacks add small, often imperceptible perturbations to training data so a model learns the wrong thing without any obvious sign in the data itself. Nightshade popularized this against text-to-image generators, but the underlying mathematics generalizes to any model trained on images, and the attack surface grows wherever training data comes from public or crowdsourced sources.

This talk walks through the perturbation objective, a bounded norm constraint optimized against the target model’s loss, and shows why that formulation is what makes the perturbation both imperceptible and effective. I’ll then apply it in two case studies. First, a malware image classifier, where poisoned samples slipped into a public training corpus cause the model to miss a targeted malware family after retraining. Second, a medical imaging classifier, where the same perturbation technique shifts diagnostic accuracy on a clean test set. You will learn how these attacks are done, how they can be caught, and how far current detection methods actually get against this class of attack.

Filipa Barros, PhD, is Head of Research at Blindsight Technologies, an AI security startup based in Zurich building tools for training data integrity, runtime security, and agentic AI governance. She is an Invited Lecturer at multiple universities and has presented her research at international conferences, with publications in venues including EAAI. Her PhD research applied machine learning to astrophysics, and she now works at the intersection of adversarial machine learning and applied AI security, with a focus on how training data can be manipulated to compromise deployed models. She splits her time between academic research and building security tooling for production AI systems.

Attackers are using AI to break into systems. Bug bounty researchers to flood your inbox. Even managers are using it to write emails. Defenders are still triaging last quarter’s backlog.

This talk is a field report from building an AI agent that audits and pentests a real banking ecosystem. We’ll walk through the engineering that made it work, what we learned and how the same foundation now automates a growing chunk of our product security team’s work, scaling a small team to something closer to attacker speed, on a realistic budget.

Luis Fontes is a seasoned security engineer with nearly a decade of experience helping organizations strengthen their security posture and defend against evolving cyber threats. Over the past four years, he has focused on the financial crypto sector. Currently, Luis works at Xapo, a crypto-native bank, where he develops and implements advanced security solutions to protect customer assets and ensure the safety of banking operations in a highly regulated environment.

Udbhav Tiwari is the VP for Strategy and Global Affairs at Signal. Udbhav’s experience in the technology sector spans both global and regional contexts, where he was formerly the Director for Global Product Policy at Mozilla, with prior roles at Google and the Centre for Internet and Society in India. He has testified before the U.S Senate Committee on Commerce, Science and Transportation and been quoted as an expert by CNN, The Guardian, Wired, Financial Times, BBC, and Reuters. Udbhav is also an Executive Member of the International Academy of Digital Arts and Sciences (IADAS) and the Advisory Board of the Centre for Democracy and Technology (CDT).