2025-06-29 –, Soprano A
Go beyond static artifacts and canned simulations. This workshop introduces a next-level threat actor emulation, immersing you in a live fire dissection experience against implants inspired by Advanced Persistent Threat (APT) TTPs. You'll execute these multi-stage implants within your analysis VM and watch them interact live with our custom, controlled C2 infrastructure – a rarity in typical analysis. Decrypt actual network traffic, reverse dynamically delivered payloads, and unravel the entire kill chain as it happens. Prepare for a hands-on CTF challenge analyzing a uniquely realistic, sophisticated, and interactive threat.
"Ghost in the Machine" offers an unparalleled reverse engineering challenge, leveraging our next-level threat actor emulation framework to simulate an APT-level campaign. Forget analyzing isolated samples; here, you engage with a living, breathing emulation in real-time. We provide an initial dropper, mimicking sophisticated actor TTPs, designed to install the primary implant onto your analysis virtual machine.
The core of the workshop—and the CTF itself—begins the moment you execute that dropper. You will witness the implant establish persistence, initiate contact with our live, interactive Command & Control (C2) server, and begin its operational lifecycle. Unlike typical analysis where interacting with a live C2 is impractical or impossible, here you directly engage with our controlled infrastructure. Your mission is to dissect this entire process dynamically. This isn't about looking at pre-recorded data; you'll capture and analyze actual network traffic, grappling with custom protocols layered with realistic encryption and obfuscation designed to thwart analysis, common in APT operations. As you progress through the CTF challenges by reverse engineering the implant's behavior and C2 communication, it will receive commands and download subsequent malicious stages directly from our C2. You must then analyze these newly delivered payloads in real-time, continuing your dissection of the evolving attack chain. This hands-on engagement demands the use of your full toolkit to unravel the complex, multi-stage operation as if confronting a genuine APT intrusion, complete with the messy realities of bespoke encryption, obfuscation and anti-analysis techniques.
Target Audience:
Experienced Malware Reverse Engineers, Incident Responders, Security Researchers, Red Teamers studying advanced TTPs, and Threat Hunters comfortable with low-level analysis and complex threat structures. If diving deep into sophisticated, live malware excites you, this is your challenge.
Prerequisites:
- Hardware: A laptop capable of running a Virtual Machine smoothly.
- Virtual Machine: A working VM (Windows 10 minimum recommended) WITH A DIRECT INTERNET CONNECTION. This is non-negotiable. Your VM will make live connections to our controlled C2 servers. Ensure your host machine and network permit this outbound connectivity for the VM.
- Essential Toolkit (Installed within the VM):
- Disassembler/Decompiler: IDA Pro (with Hex-Rays preferred), Ghidra, Binary Ninja, or Rizin/Radare2.
- Debugger: x64dbg or WinDbg (having symbols configured is a significant advantage).
- Network Analyzer: Wireshark is highly recommended.
- Hex Editor: Your preferred choice (e.g., HxD, 010 Editor).
- Scripting: Python (3.x) is strongly recommended for automation tasks like decryption, protocol parsing, or log analysis. Basic scripting ability is expected.
- Knowledge & Skills:
- Solid understanding of x86/x64 Assembly language.
- Proficiency with Windows API & Internals concepts (Process/Thread structures, PEB/TEB, common API usage patterns in malware).
- Familiarity with the PE file format.
- Strong networking fundamentals (TCP/IP, HTTP/S).
- Working knowledge of fundamental cryptography concepts (XOR, common symmetric ciphers like AES, block cipher modes).
- Patience, methodical analysis approach, and troubleshooting skills are essential.
Takeaways:
Participants will gain unique, hands-on experience dissecting a complex, multi-stage APT-inspired threat via an advanced, live emulation framework featuring heavy encryption/obfuscation and direct interaction with a live C2. They will master dynamic analysis techniques against an interactive C2, gain deep insights into sophisticated TTPs, and prove their skills by capturing the embedded CTF flags.
Silvio La Porta is CEO and Co-Founder at RETooling defining and developing Threat Actor emulation platform enabling red team to recreate a realist attack scenario. Previously he was a Senior Cyber Security Architect designing security products and researching advanced detection technology for complex malware/APT. Silvio previously was a lead research scientist with EMC Research Europe based in the Centre of Excellence in Cork, Ireland. His primary research focus areas were real-time network monitoring and data analysis in smart grids to detect malware activity in SCADA systems and corporate networks. He was also leading Security Service Level Agreement (Sec-SLA) and end user security/privacy protected data store projects for hybrid Cloud environment. He is a frequent speaker in professional and industry conferences. Before joining EMC, Silvio worked as a Malware Reverse Engineer in Symantec’s Security Response team in Dublin, Ireland. Silvio holds a PhD in Computer Network Security from the University of Pisa, Italy.
As Co-Founder of RETooling, Antonio Villani dedicates his full attention to developing red-team artifacts, including the adversary emulation library. His current work builds upon a career primarily spent on the blue-team side, where he specialized in reversing sophisticated implants and delivering crucial insights to cyber-defense and threat intelligence teams. Antonio now leverages this deep understanding to meticulously analyze complex implants, dissecting TTPs for high-quality reimplementation. He also actively contributes to the cybersecurity community by instructing on advanced malware development (MalOpSec classes) at top security conferences. His academic background includes a PhD focused on malware research and digital forensics.