Amged Wageh
Sr. Incident Response Specialist
Kaspersky
A senior incident response specialist specialized in digital forensics, reverse engineering, and threat research. I lead end-to-end cybersecurity investigations, perform comprehensive compromise assessments, and proactively hunt and detect advanced threats across diverse environments. I am the author of the DriveFS Sleuth tool and an active contributor to the cybersecurity community through in-depth threat research and tool development that has been referenced in SANS FOR500 and FOR508 courses. I am also a public speaker at Black Hat and other industry conferences, with a proven track record of guiding organizations through complex security incidents.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Docker Internals as a Detection Weapon: Uncovering a New Self-Spreading Crypto Campaign
As container adoption grows, attackers are weaponizing misconfigurations to build autonomous, self-propagating infrastructures. This session presents original research into a previously undocumented attack campaign that exploits exposed Docker APIs to deploy a dual-implant threat: a Go-based propagation worm and a Dero miner variant. What makes this campaign especially dangerous is its "no-C2" architecture; each compromised container autonomously searches for other vulnerable networks to infect, resulting in exponential infection growth.However, the attack is only half the story. The second part of this session addresses a critical forensic blind spot: the visibility gap in host-level execution logs. Traditional logging often lacks namespace or cgroup context, making it difficult for responders to distinguish containerized activity from host processes. I will introduce a technical methodology to bridge this gap by analyzing container internals from a cybersecurity perspective. This includes leveraging a "bottom-to-top" approach to track malicious processes back to their origin by understanding the role of shim processes (like containerd-shim-runc-v2) as subreapers and the behavioral differences between foreground and detached runc modes.This session equips threat hunters and incident responders with practical, vendor-neutral techniques. Attendees will learn to identify high-risk indicators, such as unauthorized Docker CLI deployments inside namespaces, malicious entrypoints, or non-standard BusyBox shell applets, providing a retrospective view to determine root causes even when in-container visibility is non-existent.
- 12:50
- Wed
- 02 Dec
Stage:
Briefing Stage 1
Sessions Type:
Keynote