Ghost in the Machine: Live Fire Threat Actor Dissection... the long way
No ratings
Presented at x33fcon 2026 by
Beyond static labs: a hands-on APT emulation workshop. Run multi-stage implants in your VM against our controlled C2, decrypt live network traffic, reverse dynamically delivered payloads, and dismantle the kill chain - ending with an advanced malware reverse engineering experience. Go beyond static artifacts and canned simulations. This workshop introduces a next-level threat actor emulation, immersing you in a live fire dissection experience against implants inspired by Advanced Persistent Threat (APT) TTPs. You'll execute these multi-stage implants within your analysis VM and watch them interact live with our custom, controlled C2 infrastructure – a rarity in typical analysis. Decrypt actual network traffic, reverse dynamically delivered payloads, and unravel the entire kill chain as it happens. Prepare for a hands-on challenge analyzing a uniquely realistic, sophisticated, and interactive threat. Prerequisites: Hardware: A laptop capable of running a Virtual Machine smoothly Virtual Machine: A working VM (Windows 10 minimum recommended) WITH A DIRECT INTERNET CONNECTION. This is non-negotiable. Your VM will make live connections to our controlled C2 servers. Ensure your host machine and network permit this outbound connectivity for the VM Essential Toolkit (Installed within the VM): Disassembler/Decompiler: IDA Pro (with Hex-Rays preferred), Ghidra, Binary Ninja, or Rizin/Radare2 Debugger: x64dbg or WinDbg (having symbols configured is a significant advantage) Hex Editor: Your preferred choice (e.g. HxD, 010 Editor) Scripting: Python (3.x) is strongly recommended for automation tasks like decryption, protocol parsing, or log analysis. Basic scripting ability is expected Knowledge & Skills: Solid understanding of x86/x64 Assembly language Profiency with Windows API & Internals concepts (Process/Thread structures, PEB/TEB, common API usage patterns in malware) Familiarity with the PE file format Strong networking fundamentals (TCP/IP, HTTP/S) Working knowledge of fundamental cryptography concepts (XOR, common symmetric, ciphers like AES, block cipher modes) Patience, methodical analysis approach, and troubleshooting skills are essential