Part #1 – Cyber Operations by China and Russia: Analysis of APT Actors and the Basics of Attribution (Trained by Cybule.cz)

The first part of the workshop focuses on cyber operations conducted by the Russian Federation and the People’s Republic of China through an analysis of two selected APT groups. Participants will gain an overview of these groups’ motivations, typical targets, and the tactics, techniques, and procedures (TTPs) they employ, based on specific case studies. Emphasis will be placed on understanding the broader geopolitical context of their activities. The workshop will also include an introduction to the attribution of cyberattacks using analytical frameworks such as MITRE ATT&CK, the Diamond Model, the Cyber Kill Chain, and the Alternative Hypothesis (ACH) method. In the practical part of the seminar, participants will practice detecting indicators of compromise (IOCs) and identifying the individual phases of an attack.

Part #2 – External Threat Hunting – Unmasking Adversary Infrastructure (Trained by DCG420.org)

In the second part of the workshop, you will delve into the proactive discipline of external threat hunting, which focuses on identifying and monitoring adversary infrastructure before it is used in an attack. Participants will learn to use tools for scanning the entire internet and specialized techniques to detect command-and-control (C2) servers, phishing sites, and other malicious assets associated with sophisticated threat actors, particularly those attributed to nation-state operations from China and Russia. We will examine key artifacts and pivoting techniques used to map attackers’ networks and understand their operational methodologies. 

We will cover the basic use of free versions of tools such as Shodan, Censys, and FOFA, and introduce critical fingerprinting concepts such as JARM. A structured methodology for conducting external hunts will be presented, culminating in a guided use case simulating the tracking of infrastructure potentially linked to Chinese or Russian actors from the first part of the workshop. Participants will leave with actionable techniques and a proactive mindset for external threat hunting.  

Part #3 – Forge Your Detection Against Advanced Threats (Trained by DCG420.org)

In the final part of the workshop, we will focus on creating detection rules to counter potential attacks by APT groups. To do this, we will use the open-source tool Hefastos.org, it is an elite detection workbench that replaces static documentation with a Visual Graph Engine. It streamlines security engineering through a Git-native „Detection-as-Code“ workflow, automatically converting visual capability maps into valid SIGMA rules. Assisted by AI and fully integrated with MITRE ATT&CK/D3FEND/ENGAGE, it allows security teams to design, automate, and scale their defense logic visually.