Transcript for "Inside the Adversary's Toolkit: The 2026 Threat Landscape": Hello, and, good morning, good afternoon to everyone who joined us. Let me just share my screen real quick. How do I do that? Screen. Okay. I think I'm pressing screen and this one. Yeah. I think we can see that. Okay. So hello and welcome, and it's very nice to be be here and to be presenting, the 2026 threat landscape inside the adversary, toolkit. And today, I'm going to talk about, research, by us, by Flare. So everything that I'm presenting is something that was found, by us and, basically, via the platform. So let me start with that. So I'm going to first explain what is the adversarial toolkit. I must say that when I thought about the title, I said, let's do an adversarial toolkit, and then I thought to myself, what is an adversary toolkit? And then some, selected tools, basically, what we found, throughout these, ten past months. And also to show that within those adversarial toolkits, there are also some risks for the attackers themselves. And then how can you do a talk about the toolkit in 2026 without talking about AI? So I'm going to, take some AI powder and put some above these tools and show you what the attackers are doing in 2026 with, AI. And... Oh, sorry. And then a little bit of summary just to talk about the bigger context and what we are doing and how we are doing it and, how these kinds of cases, can be found. Okay. So what is an adversarial tool? So first of all, when you think about, adversaries, threat actors, attackers, what they're doing, they... The first thing that they wanna do is to gain access. Well, it's a bit of a lie because the first thing that they want to do is to create, their infrastructure and, basically, to, to groom it. But, from attackers' perspective, the first link or from defenders' perspective, the first link is, to gain access. So they're trying to gain access, and then they're trying to execute something. They're trying to, execute a malicious code, and how... And the question is how they are doing it, what they're using, and then evasion. So so I spent the last seven years, I would say, just specifically on this, category or in this technique, evasion and what the attackers are doing in order to evade defenses. And when we talk about the cat and mouse game, basically, what everyone is talking about, when it comes to threat actors and defenders, I think that the main job, the main thing that we see is in the evasion space because, defenders are able to, write detections, write defenses, write things that block attacks, and attackers are trying to bypass them. I think that is the main thing that we are seeing. And, so this is control, and it's kind of binding together, command and control and, basically, the communication from the attacked, environment to the, detector, but, also, I inserted inside, the impact and, basically, what the attackers are trying, to gain. Okay. Okay. So if you are moving from tools to an attack chain, there are many possibilities. Basically, endless possibilities to describe that and to talk about it, but I selected, five specific, tools that we tracked and found, in the underground. And these tools are basically, I would say, examples to what you can find and how you can adjust it into, your use case. So for instance, we see, in the environment of the law or basically what that... How the attackers are trying to attract their victims, a lot of fake verification pages. So we are going to talk about the infrastructure. We are going to talk about what the attackers are doing, how they're doing it, and and then, the delivery execution, click fix attacks, and mostly, we see PowerShares against Windows systems. And then in the evasion, which is basically how the attackers are hiding their attack, I wanna show you an example of a packer, which is basically a software that the attackers are using, in order to, obfuscate or to hide their attack their attack. Will there be a recording available? I think so. That's a question, later Joe will be able to answer. And control, I wanna show you how attackers, are using a VPN, rats, and so on, and the monetization. Okay. So let's start with a few, selected tools. And what we've seen, in 2026 is we've seen lots of infrastructure. We've seen, that attackers are building, huge infrastructures like, domain registration factory, and they're using it either for a specific campaign or as, selling it as infrastructure as a service. One example was, the shiny hunters. So the shiny hunters, like, in 08/20/2026, we've seen a campaign. They are exploiting the top level domain of claim or the top level domain of info. What they did is in August 2026, they actually, said that they are adding another division or another department to their operation, And that department will be pure social engineering via AI based, calls, vision or calls. So if, you don't know, the shiny hunters, they are, ransomware group. They are active since 2020, and, they had lots of campaigns, lots of attacks. They are collectively, group of threat actors, connected with DECOM and LUPESUS, many publications about what they've been doing. And, specifically, that campaign, they actually tailored the infrastructure, tailored, domain registration, and that actually helped us while we communicated with some of the potential victims. It helped us to, prevent or basically warn them in advance about this specific infrastructure being built and who. So one of the things that we've, that we've saw... That we saw, was a specific, infrastructure of about 1,500, IP addresses. And some of the activity on, this, the live part of the infrastructure, it's it supported a click fix attacks. So, so... And I'm going to talk as a reason about click fix attacks. Some of them were for scam, for fraud, to steal Bitcoin, to steal cryptocurrency, and so on. And, you can really see the connection, between the infrastructure itself and what they have been doing. So part of the infrastructure was dedicated... Was, basically, the threat actor group themselves, services, or I would say, their own, for their own use. So one part of that was Cloudflare, and you can see, that this looks like Cloudflare. And this is a really nice one because what they are doing is they are offering services of residential IPs. These are, like, vetted residential IPs. And this is like an ATM machine. You put some money and you get some proxies. And, it's not something new. It's not something unique. But this was part of the infrastructure itself, and it was supposed to also support the infrastructure and the attackers themselves. But, also, they offered some of it to, to other threat actors. So this was something that we saw. Another thing that we've seen or another attack aspect, and this is specific in Russian, that that specifically the infrastructure that I'm talking about, it was in a... Was linked to Russian speaking, threat actors. And, this specific one offers the... Offers the threat actors to sell them white pages. Now what is white pages? So these are basically white pages. So if you go to the Internet and you land on an innocent, blog or a service website or something that is completely... That completely looks like innocent or, like, homemade, blog, there is a chance that it was prepared by, threat actor in this white page factory. And behind this, you could actually see, an entire world of scam. So we saw that for white pages that were prepared for, like, activities and experience like Disneyland or zoos. So behind this were links to phishing pages. And, within the web page itself or by a specific invitation or email, you could go... You could get, special key inside the URL, and then you get access to that phishing page, and you get phished. The the people steal money that way. But the baseline or the underlying technology that enable it was the white pages at the... In at scale. And with AI today, basically, you can do... You can even start start an entire website if you got the skills and the MCP server ready. You can do it in a matter of seconds. So this is something that you see that the attackers are doing actively today. So I promised you click fix and now, for click fix itself. So, click fix for those of you who are not familiar with it, you get the lure. So you get, an innocent, web page that you are getting redirected, and then you, get a problem. So the problem is you need to verify that you are human and then, fake solution. So if you are technical, you would say, okay. This is odd. Why do I need to start to use my run box? But if you are nontechnical and this is the majority of people who are the targeted, victims, you'd say, okay. So I'll just need to do... Press this nice Windows button and r and then to paste, to paste something. And when you do that, there is a user execution because you are running a command, and you have a silent payload. Usually, they hide the payload, so the user won't see it, and something is executed in the background. And one, I would say, subtechnique that we saw actively exploited in the wild, in order to bypass defenses is when the victim goes to the Lou website. We saw that. There is effect cloud flare... Human check. And then, once you do the check, then you did an action, and the, JavaScript is running in the background and, attaching to the clipboard malicious command. And then the Windows run box opens, but then something else happens. Instead of a malicious command like downloading a payload, to one, there is just a DNS call or a DNS request of TXT at 256. And what happens in the background is that another malicious code, malicious shell code is attached and running, and this is basically how the main payload is delivered, which is a nice technique that also, is not visible to a lot of defenses and detections. Okay. So concerning evasion and when you think about evasion, there are basically endless possibilities here. I think that this is also the biggest, the biggest category in the MITRE MITRE attack framework. So I chose a Packers, and, I wrote a specific threat hunting technique. It's a skill or a set of skills that I'm using, and it actually helped me to get into, Defcon thirty four and, Blackhead, '26. So, by the way, if you are in, Blackhead in London, so, come and say hi. I will be talking about ransomware groups and how you can find them based on, breadcrumbs from the the dark web. So I ran this, as part of a new project, and I, and I want to show you how I'm doing it, because the the outcome was actually amazing. So, specifically, I wanted to... This project to find, attacks against financial institutions, financial organizations. So what I did is I searched for Python scripts. You can see from the title which said research seed. And I look for import of base 64 and subprocesses, which is basically... I'm trying to hide something. Right? Or, something is, at least encoded. And it took about three hours of run. And at the end, I got, above the, 3,200, indication of compromise, and they were fresh because, the data that I ran on was was a week old. So I limited my query to be a week old. And it was based on, almost 500 Telegram channels, about, 460, 100, thousand, sorry, subscribers, out of which we identified 500, malicious threat actors and, 3,400 distributed events. This is basically the events that you may know, from Flare specific pages or specific Flare events. And inside, there were 1,200, unique scripts and 25, it should say 14, sorry, categories of tools. So this is basically the research in figures. And, the research flow was that I used the seed that I showed you, the import seed. And then I got to 3,400, raw events. And this is basically, a lot of events that could also be some that are irrelevant, some that are, misleading. But I was able to narrow down based on my query to a specific pivot. So I found, one shared packer that the threat actors were using, and I can say that I I call it the Arab bazaar, but it, it somehow grabbed, mainly Arab speaking Telegram channels. I didn't aim for that, but when I saw the outcome, I was really happy about that. And I was able to classify into 14 tools, a thousand, relevant malicious tools to the pecker itself. Remind you, there were 1,200 scripts and a thousand relevant to the pecker itself. And altogether out of that, I extracted a 2,300, indicator of compromise. So this is how the packer looked like. And a packer, if you don't know of specifically that tool... So whenever you, deliver a malware, let's say remote access Trojan or or a cloudworm or something like that, As an attacker, you have the... You you feel that the defenders will catch it based on a signature. So SHA 256, SHA one, MD five, all the above. So... Or, they will be able to, see some strings. So what they are doing, they are packing it, and they are obfuscating it and encrypting it. So, we won't be able to detect it and to stop the attack. So I thought to myself, what if we target that specific tool? What if we can find that tool and, find the the customers that are using it and based on that to find the indication of compromise? So, the outcomes themselves, you can see that 400 and something fishing kits, account creators, proxy scrapers, and so on and so on, and IP addresses, telecom, tokens, and so on. So, I I just want to stop here and to say that I submitted this to Blackhead Asia, and hopefully, I get accepted. And if so, I invite you to come and see the talk because there are actual, really interesting things that I saw there. For instance, JAR three and JAR four, bypasses and, data center, passes and cookie creators. Many interesting things that can be really, really actionable for defenders, both to write specific tailored, detections or more behavioral detections that can really help, that can really help with that. The the... Just the reason I know that I work, for, a little bit over than three hour... Three years with IBM Security, specifically,, and I saw a lot of attacks against banks, against insurance companies. And this is the way that we... Part of the way that we worked in order to defend that. So I know that these are really actionable and that organizations that struggle with, attacks against online, assets, like, websites, like, like online shops, this could be really significant, to look at. Okay. So now we are moving to a control, and and and this is a really cool tool, that I found, in Telegram groups. And it is called a firewall file con manager. And this is, also a part of a talk that I gave in Defcon thirty four, in August this year. And, specifically, when I found it, it showed a link to GitHub, and you can now download the tool. And they also have, Telegram group where they, talk about it. So when I dig into that, they actually had two Telegram groups. One of them was a broke... Broadcast channel. That means that there are, almost, 4,000 members, but they cannot communicate. Just one or two or three managers, and they control their conversation. And, there were multiple messages, the activity between November 24 and July 26. But there was another group of almost thousand participants, which started a little bit later, and that was an open chat group to discuss about this tool. So that was interesting, such a nice community, for the tool itself. And you can see that they released, a lot of notifications about... You can see from the, icons below of the participants that they look suspicious. But they released a lot of features, a lot of tools, a lot of things, and you can see the panels themselves. Basically, they offer, some capabilities of creating new user, deleting users, editing details. And I'm going to explain what is a proxy VPN, tool, in just a couple of slides. And, they even asked the participants if they want a new, script, a new tool, and not capability, which was really cool. So, maybe I should have started with this. So what is a VPN or proxy tool? So the Apple, part of the picture, whenever you go to the Internet, you use the HTTPS, sometimes HTTP without the secure layer, and you go to a web server, and then you go to the Internet. Right? So you're going through, your service provider, your ISP, and, basically, they can see the communication. So when you're using a VPN, then everything is encrypted, and you're going through a specific VPN server. It could be NordVPN. It could be, whatever VPN, service that you're using. So the ISP, provider, all of a sudden cannot see, the communication and it is encrypted. You are directly communicating with that web server. And when it comes to when it comes to that VPN service or the firewall proxy, So what they are doing is they are obfuscating the transport. So instead of it too... So you can do a communication via SSH, but it won't look like you are doing SSH communication or any other channel, IRC or something like that. They will make it look like the communication is via HTTPS, and you are talking with Facebook, for instance. So the outbound communication will look like you are talking with Facebook or you are talking with, I don't know, with Cloudflare. So at the end of the day, it will look, benign, not suspicious, and you wouldn't, even think about it. And, this is just how the panel look like, specifically. And we'll get back to that VPN because that VPN tool, was completely rigged with, with men in the middle and with vectors, and it will be really nice to show that. But the day to day lives of threat actors, they're using it. Why would they use that? So for instance, they hacked, and this whole thing started, based on, one of my honeypots. When I worked, previously with Aqua Security, I had, like, 300, 400 honeypots at any given time of services. One of them was SSH honeypot. So whenever someone gets into the SSH honeypot, they are trying to do something. And what they did is they, installed this tool, and it looked like an HTTP communication. And they... And it, reduced a little bit the suspicion of, the attack. But, also, attackers or, threat actors are using it in order to manage their own VPN services. So think about it. You see, like, cheap VPN for $2 a month in The UK, and and this is not theoretical. You can really see those. And you thought... Think to myself, okay. I can do that. And they are basically using this VPN tool in order to manage all these customers. Okay. And lastly, the money of the monetization. So we keep seeing millions of millions of logs of info stealers on daily basis. And you can see in those, logs themselves. You can see, for instance, the malware family. You can see the time stamp. And this one really... It was part of a talk, another talk that I did. And I noticed that if you see above the creation date, you can see October 6, '5, '28. And if you see below the second arrow in red, you can see that the creation... The estimated creation is, three twenty eight. So that means that, it took two hours for the attackers to bundle this, infostellar log and to push it to, their channels. And I have even seen, shorter periods. So that means that the attackers are becoming really, really fast in the triage or the, understanding of the... What they have. So, normally, when the attackers are, attacking with an infosteiler, they do the installation. It do the... It does the exfiltration. It could be simultaneous, so it could be, streaming of, the data. And, basically, they're taking out all the valuable things, the DOM elements from the windows, the, the the database, the, obviously, cookies, obviously, credentials, maybe some files from different locations. We are seeing more and more that they are targeting the AI places, like the cloud, code libraries or where the configuration are kept. So we see more and more of those. And you can see that now the problem is we have lots of info stealing logs. How can we say that they are, useful? And the the... It's it's very simple. They're using AI, and I'm also going to show it next in the deck. So you can see here the file location. This is basically the malware that ran in the background, the CPU, lots of information. And these are just part of the examples that we've seen, and these are, from the past, week. So you can see, someone's, AWS Amazon billing sign up. And it really caught my eye because this is the root, credentials. Right? This is the root credentials for Amazon. Whenever you do a sign up, not sign in to the billing, that means, the... Or register to the AWS. That means, that this is kind of like the root or a very powerful identity. Another thing that I saw is Corweave. If you don't... If you are not familiar with Corweave, this is like the NeoCloud. They have racks of racks of, servers dedicated for, for AI. Some of those cost between 1 to $2,000,000. So we are talking about, some extremely strong computation, and you can also see access to, the new clouds, which is very interesting. Also, I anonymized this company, but this is a very, well respected Fortune 50 company. And you can see here their VM orchestration, Okta, my workload jobs. So, basically, you got a lot of invaluable information about the old credentials about this company, and this was also fresh, from the past week when I, found it. Okay. So now let's, do you have any questions, by the way? No VPN, $2 per month. So you see, even with no VPN, it's $2. So I think they've been giving to them for free. But but I think this is like the, the, on sale, offering. It's like special offering. I don't think that normally no VPN will cost... Unless it's norm because it's supposed to be d. And then it's a it's a typosquatting or a look alike, and then I... I'm sure that it will cost $2 a month. Any other questions, in the audience? I see. Okay. So, this was part of hacking the hackers, whack hackers, and this is basically a supply chain backdoor in the underground VPN infrastructure. It's a talk of, Defcon, and this is me. And, just a reminder, I spoke about the firewall file con. And now I'm going to show you what they hit inside and how. And, I do that for two reasons. First of all, to show you that the attackers themselves with their toolkit and with the... What they're using, they're also, prone to attacks and basically, getting attacked. And also to show you examples to how a supply chain can look like... A real supply chain can look like, against you because it doesn't mean that tools that you are downloading won't get... Won't have the same, backdoors and whatnot. Okay. So we are going to talk about four elements that they found inside this tool. So the first one was really simple. They injected, their own permissive SSH configuration, and you can see that it permits, root login and that the password authentication is also on. So I must say for that specific tool, firewall, Falcon, it wasn't that exciting. This is not a real finding by itself, because it's just really permissive configuration. And the tool does say that he's... He needs SSH permissive configuration, but this is key and extremely important for the next three, or the next two, attack elements that were inside the tool. So the second one was, man in the middle. And the way they did that, they hid inside the code inside the GitHub, a link, and the link downloaded another tool. After the initial tool was was installed, it actually fetched for another tool or another script. And inside the... That script, they downloaded the the the... It was s a... SHC, which is basic... Basically an encrypted executable shell. And, inside, there was two... There were two elements. First, root CA, and the root CA is basically, sits inside your, your system and, enables communication or enable the the attacker to open the the encryption. And the second thing was they promised that they are using a VPN tool, located in Brazil, but they did a bypass to the the domain name of the tool. So, basically, whenever you gave from the server or from the location, the system that you installed the tool, a call to the legitimate domain of the Brazilian company, it was rerouted to, to the attacker's IP. And that's a problem because that's basically a man in the middle. So what happens whenever there is a communication from your infected, device to Facebook, for instance, the communication goes through the attacker VPS. The VPS, strips the SSL and then sends a request to, Facebook, get backs, the request, and he can send it, forward it, with the root CA of the file of Alcon back to the victim's machine. That means that they basically control the flow, and they can attack the very same attackers who are using the... Their tools. Another thing that we saw in older versions, they hid, this nice Telegram bot. So, basically, whenever someone installed the tool, there was a message sent to the Telegram bot with the IP address, the ID of the machine, the number... The operating system, the number of calls, basically, a fingerprint of the machine. And more importantly, what they did is they created the user, and combined with the fact that the, shell was open for root user to the Internet, basically, they created a backdoor. So this is a backdoor, and they were able to go and control the machine and do whatever they want with the machine itself. The last element that they did is that they, actually, the the the DNS TT that they used, they actually left the administrator key inside the tool. And, basically, this allowed anyone... I think this was not an attack, but this was basically a negligence. They allowed, a, to control the infrastructure from the DNS level, and b, to basically show, how their victims look like. And these are basically, the DNS calls that you can see, and you can reconstruct them to victims. And you can see that the victims who installed their software were from The US, from Canada, Europe, Brazil, Australia, and so on. So this kind of provided a very, nice and clear picture. You can look for the Defcon talk itself in YouTube, or in, on the November 5. I'm going to give, another talk, in in... To a website in Brazil, so you can look for that as well, via LinkedIn. I will share later, link for that so you can get registered, and you can hear the talk, the the the full talk about it. Okay. So we talked about the tools, and I've given you several examples to what the attackers are doing, how the investigations look like. And now I want to talk about something which is, at least to me, it's very interesting about how AI influences, the toolkit itself. What kind of influences do we see, of AI on the attacker's toolkit? So, the first and more direct is, for GPT. And I know that it's in Russian, but you can see that there is a lot of interest in, for GPT or something GPT in general. So this is the main, when you think about, the AI influence. So, I would say a year ago or two years ago, something GPT was the main thing that we've seen, and you can see the time stamp, which is 2024. It's aligned with what I'm I'm saying. And, basically, it corrected, like, the Nigerian prince or any other scam. It just corrected, the the text, and the attackers were able to steal a lot of money. But ever since that, and this is a tutorial from 2026 that we found with with Flare. So you can see there... It's it's not just, for GPT. There is almost everything GPT, RAT, HAC. And this is... These are basically bypasses of the Frontier model or the more, I would say, weaker models, just bypasses of, of their defenses or, their guardrails not to execute malicious commands. So these are basically, Worm GPT is a little bit buggy. Yeah. Yeah. So I I actually have a a blog that I wrote about some of the pen testing tools. So you might be interested to read about that. It's also published, I think, it was published, I think, a month ago. It's very interesting. You you should, definitely read about that. Pen testing with AI, of course. So, and now to to the problem that attackers are having, and I spoke a little bit about it, spoke about it a little bit earlier. So, in the eighties, nineties, we got a lot of sensors, then we had the storage problem in the in the two thousands. I remember working, working, I I remember that the problem was, in the storage level itself. And the two thousands, big data problem, explosion of data. And in between, I remember working with the DBAs at IBM, and they were constantly running and patching and trying to add more capability to the to the Postgres databases, to the MySQL databases. And in 2022, the problem was of analytics and how to do it. I remember in the university, there were many talks and courses about analytics, ML, tools. But now with AI, this problem is kind of solved. And you can see that this is where the attackers are focusing, today. And these are a few examples to what they are offering and the services they're offering. Basically, full analytic dashboard on their tools. And what they are saying is that, whenever you get into an email box, you have a problem because, you have thousands or hundreds of thousands of of messages or things that you need to work on. And, in the fear that it will get discovered and this attack vector, this, initial access will be blocked, then, basically, they offer, analytics tool or analytics capability that will enable to find, the most interesting, the most... The strongest things that will help the attacker to to monetize this attack. You can see Telegram bots, and this is an example to pen test AGI, part of my... The previous research that I spoke about. And this is, pushed into Telegram groups, and you can see that they actually are doing pen testing on victims or targets and potential targets and trying to see, how they can get in. And another thing that we've seen is analytics tools or analytics services search your target. So, basically, they're saying, you just mentioned your target, and we, we we are not going to sell you, a database. We are not going to sell you, garbage, basically. We are going to do a search based on our database and to provide with you a specific, tailored solution. So for instance, you want to find the email of, of a friend or someone or, or a phone, then, basically, the... You give them the name, and they will look for it. And, they will give you all the... They give... They will give you, like, a kit, what is called false on that specific, victim. And you can see here AI analysis. This is basically analysis of a configuration of a JavaScript running on the fly and indexed. This is specifically indexed in, but it's indexed in, bots and telegrams and so on. And last but not least, this is another finding that I had or a a blog, that I wrote about the the Mycelium framework. And this is an example to what they can do these days. So, basically, they say it's a botnet, and they have a large botnet. And what they're offering is inference or basically calculation... AI calculation on that botnet. So for instance, the part of the acquisition is to find a vulnerable or doing target acquisition. This is really realistic. I told you earlier that I worked for six, seven years, with Aqua Security, and I had lots of, honeypots. So these were actually my honeypots, and this is actually what I used in order to lure and deckers. And there are many, many exposed workloads in the wild, which actually carry those vulnerabilities and are, two victims. And you can see that they are, doing lateral movement. So the mycelium framework offers lateral movement to SSH, to VNC, looking for SMBs, basically whatever they can. They are also doing credential harvesting. So this is a capability of an infostealer. So the lateral movement is a warm capability, and credential harvesting is, an infosteiler capability that they, onboarded into that framework itself. They are using, a lot of, stealth and defensive vision techniques, like runtime patching, sandbox detection. They're encrypting the the strings. So a lot of these, defensive agent techniques, were something that I investigated in past. So they they are not only doable. Attackers are really using them in the wild. They also offer, like, production grade engineering. You can see that the, from the snippets that they shared and the files that they shared, that the code is in production grade and really high level and encrypted, c two capabilities. So they offer three tier plans, the premium tier, which is basically, they install on the botnet, on the victims, or they they don't install. They use stolen or compromised credentials, the GPT four, cloud API, in order to, to... And so to send queries or prompts to models, on on less stronger tiers. They are actually installing and running Ollama or local models in order to do the inference on the models themselves. And lastly, on the, Internet of things or weaker machines, they are offering, CPU cap... Capacities and capabilities, for reconnaissance, for instance. And so so for instance, you can get an entire attack chain. You start with a reconnaissance maybe to scan a target, to scan a destination, and then you can, run some planning of the attack itself on the local, model tier. And then for the premium tier, you can launch the attack, use tools, and do whatever you want. So this is a really, possible, orchestration that attackers either doing now or they will be doing it really, really soon. And for now, they are offering it for social engineering engines. So for instance, if you want to send social engineering attacks against Slack, Telegram, Discord, or what they called a neural propagation. Okay. So, we have eight minutes. We'll go, summary and then a few questions. So, just to summarize, we spoke today about access and compromises, infrastructure, and services. Basically, what I wanted to show you is to start by by, showing the value in the... If you're thinking about the MITRE attack framework on the the resource development that the attackers are doing and how you can use it and utilize it for for your benefits to find, new attacks. And then some of the attacks that we see in the wild, what the attackers are doing, and, basically, some of the new... Newer techniques and new capabilities that they are doing. To speak a little bit about social engineering because the VPN the VPN attack was a complete social engineering. They actually ran an entire or two, Telegram channels, and they had a very polished, GitHub repository with, what seems to be, an open source project for attackers. But at the end, it was a social engineering, for attackers. By the way, like, five minutes after I finished the talk, the Defcon talk, the entire, environment was down, deleted, removed. The server was dead. Everything there disappeared, which, was a a win for me because I was afraid that maybe they will sue me and will say we are a very legitimate tool. No. I'm kidding because they... Their, audience... Their target audience were... Occurs in the underground. And last but not least, we talk about the... This... The angle of before the compromise. And, also, if you are interested, you can reach out and we can talk further about the research technique that I showed earlier, specifically about a few, skills and prompts that might, help you with your use cases, to find the indication of compromise, to find, information relevant to you, and basically to narrow it down and to, remove the noise and, make it, substantial, artifacts that you can use for your benefits. So I want to thank you and to ask if there are any questions, anything you want to add or to comment. Any questions? Anyone want to ask something? Yeah. I guess not. Joe, you want to add anything? No. I think we're, we're cool to wrap up, Asaf, if if there aren't any questions. Looks like Calvin submitted something in the q and a. I responded with a link. Calvin, I hope that was the blog that you were looking for. And, for those that aren't hooked up to our Discord, highly recommend joining that for tips, tricks, tips for when we're gonna be presenting next. It's an awesome community. We almost have 6,000 people in there. We're at seven eight eight. So if you could help us get to six, that would be awesome. There's a link at the top here and then in box. Really great community. We're hosting a, Halloween style hacker jeopardy soon. Oh, so. if we. got comments on Chinese tooling like Artex. I I... I'm not familiar with that. Sorry. Not yet. Not yet. I I will read about it, though, after, the call. No. But we do see some Chinese tooling. I'm not familiar with Artex. If you can share a little bit about what it is. In November, we're covering something to do with, I believe, Chinese language marketplaces. So I can put the link to register for that into the chat. Our, friend, it's an AI autonomous, pen testing system. Okay. That's interesting. So I know what I'm going to do next. We got. another one. What. kind of research area in AI cybercrime makes sense? Again, what kind of... Research area in AI cybercrime makes sense. Okay. That's a very good question, and that depends on what you are trying to defend or to achieve. So, basically, you got, in AI, you can go to the supply chain. So you got skills, you got MCPs, you got plugins, and you can investigate specifically attacks against these areas. You got prompt injections, you got context poisoning. And these are basically the attacks against the AI infrastructure itself or even poisoning, the data sets or the data that they are learning on themselves. On the other hand, you can, investigate the attacks of the AGI or the autonomous, systems themselves, like what happened with, Hugging Face and OpenAI. There is a great, black talk from the OpenAI team themselves about it. And on the third angle of that, you can talk about what I spoke, now, what attackers are doing, how they are, elevating AI, how they're using it. So it depends on what we are looking to investigate. Let's assume that it's the latter. So, basically, I'm trying to see, any hints that the, in in the underground, in flare of what the attackers are talking about. So you should look for correspondence, for tutorials, about tools, about how to use AI. So, basically, there are lots of talks about it. And then you can go and check that tool. You can go and, basically, so I myself, before I worked with the Aqua Security, I worked with another company as chief, CTI, and then we did a lot of HUMINT. So I also do HUMINT with the attackers, talking with them, trying to understand, trying to get more information about the tools themselves. I hope that it makes sense. It's a very broad question, and you can basically do a lot of research about AI because it's a very, broad topic. I hope hope it helped. Thank you, Asaf. Let me see what this one says. Okay. Calvin said you were gonna put a link to your next talk in the chat. Were you talking about the black hat talk? Black hat Asia? Oh, the the bracket, if you go to the blackhead and the, briefings, you can go and see the talk by Asaf Morag. And, in Brazil, on the fifth of of November, yeah, I'm going to talk about the Defcon. I'm going to, basically, do the same talk about the Defcon, but I don't have right now the link. So. maybe, Joe, you can publish it later in this call? I will share it with you. Okay. Okay. What else? I think, the q and a is clear. Excuse me. Alright. Okay. Then thank you very much, and you. till next time. Alright, everyone. Enjoy your days. Stay safe. Stay curious. Stay cool. Bye bye. Thank you. Bye bye.