2025

BSidesZagreb’25

Technical lectures, single track, relevant technical content with no sales talks.

Sponsored by

Photos

https://flic.kr/s/aHBqjC51o9

Presentations

Track 1:

Track 2:

The Art of Infiltration: Leveraging Trusted Relationships

Presentation

This talk examines the recent activities of Hazel Sandstorm, an actor targeting government, telecommunications, and IT organizations in the Middle East. The group employs sophisticated tactics, such as impersonating legitimate IT providers, to deceive users into opening malicious files or connecting to actor-controlled infrastructure. These deceptive strategies enable them to infiltrate organizations and gain unauthorized access to sensitive information.
Once initial access is achieved, Hazel Sandstorm leverages custom backdoors and scripts deployed on compromised devices. These tools allow the group to maintain persistence within the target’s network, making it difficult for security teams to detect and eradicate their presence. Additionally, the threat actors utilize techniques to harvest credentials, enabling them to escalate privileges and move laterally across the network.
We’ll highlight how threat intelligence efforts played a crucial role in uncovering the source of initial access, shedding light on Hazel Sandstorm’s methodologies. Through careful analysis and collaboration, researchers were able to piece together the attack chain, following the progression from initial compromise to persistence, credential access, and command and control.
Understanding these activities provides valuable insights into the evolving landscape of cyber threats and underscores the importance of robust cybersecurity measures. By studying the tactics, techniques, and procedures employed by groups like Hazel Sandstorm, organizations can better prepare to defend against similar attacks and enhance their overall security posture.
In summary, this talk will not only delve into the sophisticated methods used by Hazel Sandstorm but also emphasize the critical role of threat intelligence in identifying and mitigating advanced persistent threats. This knowledge equips defenders with the necessary tools and strategies to protect their networks from increasingly complex cyber adversaries.

About the speaker

Vladimir has over a decade of experience in cyber security and is currently a Principal Security Researcher with DART, where he has worked for the past three years. He leads global incident response efforts and conducts data analysis to uncover attack narratives. As a lead investigator, he delivers both findings and recommendations aimed at improving the security posture of various environments. Vladimir holds industry leading certifications such as GCFE, GCDA, and GSOM. In his free time, he enjoys hiking, travelling and spending time with his family.

Intelligence Driven Incident Response

Presentation

This is a tale about a long operation conducted against a ransomware group, which is still operating through a huge infrastructure owned by a cybercrime actor.

About the speaker

Vito is a specialist in Digital Forensics, Incident Response, Vulnerability Management Cyber Threat Intelligence, Threat Hunting, Security Awareness and Secure Networks Design with 15+ years of experience in the field and tons of projects completed in different regions (Europe, APAC, US, MEA) and investigating and responding to hundreds of security incidents, primarily related to APTs and Cybercrime, in intergovernmental organizations, space and defense entities and in the banking sector.

Attempt of secure development in automotive

In this talk, we will explore how we prepare for modern automotive cybersecurity development during product development. From threat analysis to writing requirements and finally testing our own products, we will cover the entire process. Additionally, we will explain how the automotive industry enforces cybersecurity and how it differs from other industries. The automotive industry has decided to use functional safety as a boilerplate for the process.

About the speaker

Jagor Čakmak has been in the field of cybersecurity for 15 years. His experience spans across Research & Development (R&D), Blue Team, Red Team, and currently, he manages the cybersecurity of the product portfolio at Rimac Technology. His current main area of interest is securing embedded systems, which control various parts of vehicles.

Privilege Escalation in Azure Machine Learning

Presentation

In this talk, we will introduce new privilege escalation techniques targeting Azure Machine Learning, a robust platform for machine learning model fine-tuning and deployment. We will delve into the technical details of the attack chain, providing a thorough analysis of the scripts, tools, and mechanisms involved. We will demonstrate how an attacker with no direct access to Azure Machine Learning and only limited permissions can escalate privileges, compromising compute instances and resources within the Azure Machine Learning environment. Additionally, we will showcase how machine learning models can be leveraged to infect containers, endpoints, and other infrastructure components. Penetration testers can incorporate these techniques into their Azure red teaming assessments, enabling privilege escalation and lateral movement across systems.

About the speaker

Christian Bortone is a penetration tester at a pharmaceutical company. With a background in engineering, he has been actively involved in cybersecurity since 2017. His expertise spans testing applications, cloud environments, systems, and infrastructure. In addition to his professional work, Christian dedicates his free time to researching Azure and Active Directory. His research can be found on the blog https://xybytes.com. In 2023, he presented a talk titled “Abusing Azure Arc: From Service Principal Exposed to Reverse Shell” at BSides Leeds.

Fighting the impossible: Supply Chain attacks

Presentation

In last few years we have witnessed many supply chain attacks. Severity of risk resulting from supply chain attacks has been recognized by many regulations, including NIS2 in Europe which tries to prepare organizations for addressing supply chain attacks.

In this presentation we will go through several supply chain attacks and pay special attention to the xz SSH backdoor supply chain attack, which is almost certainly the most sophisticated and prepared supply chain attack to date.

We will dive into both technical details of how well crafted the xz backdoor was, but also into the ecosystem of fake accounts that was created around the backdoor in order to achieve the attacker’s ultimate goal: backdoor every Linux server in the world that is using Systemd.

About the speaker

Bojan is the CTO of Infigo, where he also leads the offensive security team, which is one of the largest in the region.

He is also a Certified SANS Instructor, where he teaches the popular SEC542 (Web application penetration testing) course, of which he is also a co-author. He also teaches the SEC565 (Red Team Operations and Adversary Emulation) course.

Besides this, he uses every opportunity to trade the routine of Outlook for the thrill of engaging with advanced offensive security tools.

Finally, he is also a senior SANS Internet Storm Center (ISC) handler, where he gets a chance to play with latest attacks.

Cybersecurity Risks of AI

Artificial Intelligence (AI) has introduced significant challenges for cybersecurity defenders. AI-powered cyber threats are evolving quickly, outpacing traditional security measures and increasing the complexity of cyber defense strategies. Malicious actors leverage AI to automate attacks, evade detection, and enhance social engineering tactics, making cybersecurity more challenging than ever.

AI’s impact on cybersecurity is profound, both in defense and offense. While cybersecurity professionals use AI for threat detection and response automation, adversaries exploit AI to bypass traditional security mechanisms. Examples of AI misuse include deepfake technology, AI-driven phishing campaigns, and automated malware generation.

However, malicious actors not only use commonly available AI tools adapted for their purposes, but they also develop their own malicious AI models specifically designed for cyber offense and cybercrime. These models enable attackers to craft sophisticated TTPs (Tactics, Techniques, and Procedures), representing a significant evolution from traditional methods. By using AI, they can enhance their baits and improve success rates.

Several real-world cases are analyzed to illustrate AI’s impact on cybercrime, including both public cases and incidents from Security Operations Centers (SOCs) involving AI, some of which are restricted.

Finally, the presentation includes a brief analysis of the possibilities offered by artificial intelligence as a technology from a defensive standpoint, aimed at enhancing the capabilities and effectiveness of cybersecurity professionals.

About the speaker

MJ Casado is an expert in cyber intelligence, threat intelligence, and security intelligence, with 10 years experience in these fields. She currently leads the Cyber and Intelligence team at Marlink Cyber, where she applies her extensive experience in developing cyber intelligence products and services. She has in-depth knowledge of information gathering techniques and tools and in designing corporate intelligence/cyber intelligence units. Her current focus is on cyber and security threats in the maritime industry, but also energy, financial, and tourism sectors as well where she has extensive experience. Her main strength lies in understanding client concerns and creating services that help mitigate those risks, using intelligence techniques, especially in addressing security and cybersecurity challenges.

Vector Search for Security Operations Center, yay or nay?

Vector search promises to enhance security analytics by searching for meaning instead of traditional keyword matching, thus reducing time to write detection, and accelerating investigations. But is it the right fit for SOC environments?

About the speaker

Filip Žagar is a SecDevOps engineer focused on automating and optimizing security operations while also exploring threat detection and cloud security. With experience at the intersection of security analytics and SIEM engineering, Filip brings a unique perspective to the challenges faced in Security Operations Centers (SOCs).

Security of Communication: It’s Not Quantum Physics… Or Is It?

In an era where sophisticated data breaches and cyber threats are escalating, the security of communication systems has never been more critical. But what if the key to unbreakable security lies not in traditional methods, but in the unusual principles of quantum physics?

This talk explores the intersection of classical and quantum approaches to secure communication. I’ll bring closer quantum concepts like superposition and quantum entanglement and reveal how they enable new approach to security, such as quantum key distribution (QKD), which (in theory) offers absolutely secure communication. At the same time, I’ll discuss the challenges and potential threats these innovations pose to existing cryptographic systems but also some alternative solutions like post-quantum cryptograhy (PQC), which aims to fortify security against both classical and quantum threats using classical approach.
Finally, we’ll look at real-world applications of these technologies, including a fully-connected quantum network I helped build in Bristol (UK) and ambitious space-based communication systems using low-Earth orbit (LEO) satellites, such as Chinese Micius satellite.

About the speaker

Matej recently received his PhD degree in the field of experimental physics working on a topic related to quantum communications. During his work at Ruđer Bošković Institute, he collaborated with the University of Bristol, where he spent three months building a quantum communication network. His field of expertise is focused on the implementation of quantum key distribution in fiber-based and hybrid quantum networks. Currently, he is working in the telecom industry.

Hiding Malware in Docker Images for AWS Hardcore Persistence and Defense Evasion

Let’s build an AWS Backdoor that can evade all detection mechanisms existing so far. Are you up to the challenge?

Our objective is to execute commands against an AWS tenant from a remote location without being detected by AWS mechanisms like GuardDuty and minimizing our fingerprint in CloudTrail API call logs.

To achieve this I am going to explore a technology stack that besides its availability is not being widely used: Running Docker containers within lambda functions in a full serverless approach.

About the speaker

Santiago Abastante is former Police Officer from Argentina, now a Cloud Incident Responder and Security Engineer with over 10 years of IT experience. A Digital Nomad an international speaker, I’ve presented on Cloud Security and Incident Response at Ekoparty, FIRST, Virus Bulletin (three times), Hack.Lu, and various BSides events worldwide. I hold a Bachelor’s degree in Information Security and an MBA (Master in Business Administration).

Hackers Don’t Hack, They Log In: The Threat of Stolen Credentials

In today’s cyber threat landscape, attackers don’t break in—they log in. Identity-based attacks leveraging stolen credentials have surged past traditional hacking methods, posing an ever-growing challenge for organizations worldwide. According to MITRE ATT&CK FY23 Risk and Vulnerability Assessment, Valid Accounts accounted for 41.28% of Initial Access incidents, surpassing even Spearphishing links at 26.30%. These figures underline the reality that compromised credentials are a more frequent attack vector than traditional exploitation techniques.

This presentation will focus on providing the key insights into the ease with which attackers can obtain infostealer data and its derivatives, and the challenges that defenders face when trying to combat those intrusions.

We’ll explore:

• “The Infostealer Ecosystem”: An overview of infostealer families, derivative products, and common sources where leaked data can be found.
• “Detection Challenges”: Why detecting breaches involving stolen credentials remains a complex problem for defenders.
• “Targeted Campaigns”: How attackers use stolen credentials to fine-tune Spearphishing campaigns for maximum effectiveness.
• “Defense Strategies”: Recommendations for proactive defense, including in-house vs. enterprise monitoring solutions and their trade-offs.
• “Legal And Ethical Boundaries”: Legal considerations when gathering threat intelligence and tracking credential leaks.
• “How To Succeed Even After We Fail”: Since the attackers need to get it right only once, and the breach is inevitable.

By the end of this presentation, the audience will have a deeper understanding of the pervasive threat posed by stolen credentials, proactive measures to prevent breaches, and strategies to mitigate the impact of inevitable compromises.

About the speaker

Matija is OSINT researcher of the Croatian Armed Forces by day and Data Leak collection enthusiast by night. His professional responsibilities encompass identifying emerging threats, issuing timely alerts, and offering strategic recommendations for incident response and mitigation. Matija’s expertise lies in leveraging automation techniques for data collection, processing, and dissemination, ensuring the delivery of actionable intelligence to decision makers. Beyond regular working hours, he enjoys delving into the darker corners of the web, seeking out leaked data and compromised credentials.

Windows threats and COM interfaces

The Component Object Model (COM) is one of the fundamental technologies in the Windows operating system, facilitating interprocess communication and dynamic object creation across different programming languages. While COM is widely used for legitimate software development, its capabilities have also been used by threat actors, from APTs to cybercrime actors, to carry out malicious activities. This presentation is a result of research on resurgence of threat actors using COM interfaces for lateral movement, command and control (C2) communications, data exfiltration, persistence, code execution and other TTPs.

About the speaker

Vanja Svajcer works as a Threat Researcher at Cisco Talos. Vanja enjoys tinkering with automated analysis systems, reversing binaries and analysing mobile malware. He thinks time spent scraping telemetry data to find indicators of new attacks is well worth the effort. He presented his work at conferences such as FSec, Bsides, Virus Bulletin, RSA, CARO, AVAR, BalcCon and others.

The Hidden Threat: Unmasking Malware in Machine Learning Models

Presentation

Our everyday personal and professional life seems to be more and more intertwined with Machine learning models. Each day they are becoming larger and more powerful. But, behind every shiny new machine learning model or technology, there is a code. Where there is code, there are many frameworks and technologies, each with its distinct vulnerabilities and potential security pitfalls. Considering all this, it was just a matter of time before machine learning models would become a new attack surface for threat actors.

About the speaker

Lucija Valentić joined ReversingLabs in 2022 as a Threat Researcher. She is currently working on finding malicious software on various public repositories, doing research on more interesting ones, writing blogs about her research, and participating in research webinars.

Vulnerability regression testing with Nuclei framework

Presentation

Just like any other company that creates software, Infobip isn’t immune to vulnerabilities. In our “find, notify, and patch” cycles, we’ve run into cases where fixing one vulnerability ends up messing with something that was fixed a long time ago for another issue. To deal with this, we decided to bring in vulnerability regression testing. We picked the Nuclei framework for this because it offers a lot of options, can be modular, and there are plenty of examples available online. Nuclei uses YAML to define templates, which can be used as units for regression tests. By putting together Nuclei’s YAML templates, Notify from ProjectDiscovery, some Python code, and a Slack bot, we built a proactive notification system. This system alerts us if a previously patched vulnerability pops back up in our system.

About the speaker

Domagoj Vrataric is passionate about information security and has over 12 years of experience in the field, focusing primarily on offensive security. Currently employed as a senior application security engineer at Infobip.

Argonautica – a quest to find the Golden Ticket

Our story goes through a real-world internal security assessment of an ArgoCD environment which ultimately led to acquiring the golden ticket via Kerberos without triggering a single detection mechanism. The idea is to explore how vulnerabilities in GitOps CD environments can have serious implications on broader internal systems. Furthermore, we delve into the fundamentals of containerization, ArgoCD design and specific methodologies employed during the security assessment that enabled the takover of the cluster and the subsequent compromise of the entire domain. The session aims to raise awareness of the critical security challenges that arise when GitOps environments are not adequately protected and offer insights into the ArgoCD ecosystem and some strategies for securing it effectively.

About the speaker

Tomislav Turek works in Infobip Application security team that analyzes and performs security reviews of application systems, integrations and code. While mostly focused on application security and software engineering, he likes to tinker with all things related to security. He invests a lot of his free time in computers and loves to participate in Capture the flag competitions.

Password123!

Passwords: the bane of our digital lives, yet still our first line of defense. Despite decades of advice, people continue to use weak, predictable, and easily compromised passwords. In this lecture, we’ll dive into why this is still happening, and more importantly, how to change it. Starting with a simple breakdown of the math behind the passwords (from the ATM PINs to full-length passphrases) you’ll quickly learn what makes passwords weak or strong. Then, I’ll take you into the world of password cracking, showing real-world techniques like using word and password lists, rule and mask based attacks, and even brute force to show how seemingly strong passwords quickly fail.

About the speaker

Neven Biruški is a seasoned security professional with over 10 years of dedicated experience in the field and a passion for understanding the art of passwords since the late ’90s. Over the years, he’s cracked countless passwords learning what works and what fails. Known for blending technical expertise with approachable storytelling, he makes complex topics accessible and engaging. When he’s not cracking passwords, he’s (always ethically) breaking into other people’s computer systems conquering many large companies “before lunchtime”.

Open source training grounds for attack and response teams

Cyber ranges and training platforms provide simulated environments that replicate real-world computer networks. Among other use cases, they can be used to train skills of red teams, to teach and train defenders and to evaluate various security tools. Over the last few years, we have seen many such environments become publicly available as open source technologies. These vary from small-scale training grounds that can run on a single workstation, all the way to large-scale deployments relying on private and public clouds.

Presentation

About the speaker

Ivan Kovačević received his master’s degree from the University of Zagreb, Faculty of Electrical Engineering and Computing. After working for a while in the industry, he started his PhD research in cyber security, and worked at the university on several research and development projects related to cyber security exercises, security of critical infrastructures, and monitoring of the Croatian web.