A closer look at what we suspect is vibe coded ransomware

Foredragsholder

Aleksander Bjørkhaug

Senior security analyst in Defendable

Aleksander Bjørkhaug is a digital forensic investigator with specialization in incident handling and malware analysis. With seven years of experience from the Norwegian Armed Forces Cyber Security Center, he now works in Defendable with digital investigation and incident handling. Aleksander is also co-responsible for the course "Malware Analysis and Reverse Engineering" at the NTNU university, where he does lecturing, planing and developing the curriculum, and creating and grading exams.

Through his work in Defendable, Aleksander has worked cases like ransomware, investigating sale of company information on the Dark Web, investigating unfaithful employees, system revision and other scenarios that require digital investigation.

Om sesjonen

During a ransomware incident response case, Defendable encountered a ransomware variant that had not been observed previously. Upon performing reverse engineering on the sample to analyze its capabilities, Defendable uncovered routines, logic, and indicators suggesting that this ransomware may not have been primarily developed by a human.

In this presentation, we will delve into the core findings from the technical reverse engineering analysis of the sample. Furthermore, we will explore the observed characteristics that lead us to believe it may have been created using AI and ML, potentially qualifying it as "vibe-coded" ransomware. To conclude, we will broaden the discussion by examining the potential implications and realities of "vibe-coded" malware in the wild.

Samtidig i programmet

1. 15:00 Inside the NPM supply chain attacks: Lessons from a worm on the loose 1 · Frimurerlosjen, rom 1
2. 15:00 No Key Required: Bypassing Application-Layer Encryption with Frida 1 · Frimurerlosjen, rom 2
3. 15:00 Trust and Democracy in the Age of AI 10 · HeartBox ,Teatersalen
4. 15:00 No More Shadow IT: Governing Linux Desktops with Intune and Chef 10 · HeartBox, Byscenen
5. 15:00 Artikkel 32 i praksis: Slik ivaretar vi den registrerte 11- Breiseth, Storlon
6. 15:00 Bridging the gap between OT and IT - Expert Panel 2 · Home hotel Hammer, moen nede
7. 15:00 Integrert sikring i sykehusprosjekter - fra idefase til drift 2 · Home hotel Hammer, moen oppe
8. 15:00 Er konsulenten din en risiko i sikkerhetsgraderte anskaffelser? 3 · Hvelvet, Gullsalen
9. 15:00 Leverandøravhengighet i et beredskapsperspektiv: EU-kravene som kan endre forholdet til Big Tech 4 · Kommunestyresalen, Lillehammer rådhus
10. 15:00 Passkeys migration in the enterprise 5 · Kulturhuset Banken, Expedisjon
11. 15:00 "Last man standing – hvordan sikre operativ evne når digitale tjenester svikter" 5 · Kulturhuset Banken, Festsalen
12. 15:00 No organization is an island: hvordan finne det som betyr noe, når alt henger sammen med alt 5 · Kulturhuset Banken, Holbøsalen
13. 15:00 Beyond Standalone Risk Assessments: Making Cyber Risk Relevant for Management 6 · Lillehammer kino, sal 2
14. 15:00 Hvordan skape suksess med digitale kurs - en ærlig fortelling fra maritim næring 6 · Lillehammer kino, sal 4
15. 15:00 Lessons Learned and laughs from Incident Response 9 · Victoria Scandic, sal 3