Skip to main content
Filipi Pires

Filipi Pires

Head of Technical Advocacy
SCYTHE
I’ve been working as Head of Technical Advocacy at SCYTHE, Founder & Investor at CROSS-INTEL, BSides Porto Organizer, Red Team Village Director (DEF CON), Senior Advisor Raices Cyber Academy, Founder of Red Team Community (Brazil and LATAM) and AWS Community Builder. International Speaker at Security and New technologies events in many countries such as US (Black Hat & Defcon), Canada, France, Spain, Germany, Poland, Black Hat MEA - Middle-East - and others, I’ve served as University Professor in Master Degree in Portugal, Graduation and MBA courses at Brazilian colleges and Author book - TPRM : Connecting TPRM and supply chain security for operational resilience by Packt.

Speaker sessions

Briefings and Arsenals | Confirmed Speakers | No Session Assigned

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
  • 07:30
  • Tue
  • 01 Dec
Stage: Briefing Stage 2
Sessions Type: Keynote

DrogonSec: Multi-Engine Open Source Scanner for SAST, Secrets, SCA and IaC

Most AppSec scanners force a choice between coverage and speed. DrogonSec refuses that tradeoff. DrogonSec is an open source, multi-engine security scanner written in Go that combines SAST, SCA, Secret Detection, and IaC analysis across 20+ languages in a single binary. Four engines run concurrently via goroutines. No external process spawning. No pipeline overhead. Output in Text, JSON, SARIF 2.1, and HTML. Coverage is aligned with OWASP Top 10:2025, including the two new categories most scanners ignore: Software Supply Chain Failures (A03) and Mishandling of Exceptions (A10). Every finding ships with CWE mapping and CVSS 3.1 scoring. Secret detection runs 50+ patterns covering AWS keys, GCP credentials, JWT tokens, SSH private keys, database connection strings, and payment provider secrets. Entropy threshold tuning cuts false positives. Git history scanning catches secrets that were deleted but never actually gone. This session is a live demonstration. Real repository. Real findings. Four engines running on stage, with full output across JSON, SARIF, and HTML. SARIF upload to GitHub Advanced Security is demonstrated in real time. The session covers the tool architecture, the reasoning behind the OWASP Top 10:2025 rule design, and how DrogonSec integrates into CI/CD pipelines without becoming the bottleneck. Attendees leave with a working scanner they can deploy the same day.
  • 13:00
  • Tue
  • 01 Dec
Stage: Arsenal 2
Sessions Type: Keynote

Nation-State Attack Dissected: Reverse Engineering APT28's BadPaw and MeowMeow

In March 2026, ClearSky documented an active APT28 campaign targeting Ukrainian government and energy organizations. The group deployed two custom tools: BadPaw, a loader that conceals shellcode inside PNG pixel data using steganography, and MeowMeow, a full-featured backdoor with sandbox evasion, keylogging, credential harvesting, screen capture, and dual-channel exfiltration over HTTP and ICMP.This session is a full technical dissection of that campaign. We walk through every layer of the infection chain: spear-phishing HTA delivery, VBScript extraction, steganographic shellcode unpacking, anti-sandbox logic that checks OS install date and enumerates analysis tools before executing, and MeowMeow's C2 behavior including a required command-line parameter that defeats automated sandbox detonation.Attribution indicators are examined directly from the sample. Russian language strings embedded in source code, operational patterns consistent with APT28/GRU, and OPSEC failures that expose actor tradecraft.The second half of the session rebuilds this entire attack chain in an isolated lab using only open source tools: Kali Linux, Metasploit, Impacket, and native Windows utilities. Nine phases. Twenty-nine evidence captures. Fifteen-plus ATT&CK techniques mapped and executed live.The goal is not to describe the attack. The goal is to execute it, understand exactly how each technique works at the code level, and demonstrate how defenders can use that same reconstruction to validate detection controls against real nation-state tradecraft.
  • 14:10
  • Wed
  • 02 Dec
Stage: Briefing Stage 2
Sessions Type: Keynote