The badge for THCon2026, a DVID board, had 2 firmware : the conference firmware, which was reversed by @virtualabs here: https://virtualabs.fr/geekeries/thcon26-badge-writeup
and a challenge firmeware here: https://github.com/dvid-security/dvidv2-opensource/tree/main/workshop/thcon2026
That I solved here: https://cryptax.github.io/2026-06-thconbadge/ (writeup/spoiler).
Write-up for 2 forensics challenges at THCon : https://cryptax.github.io/thcon2026-breach/
Donโt forget to lock This is the first challenge of the Forensics category. 1 We seized a suspect's computer and managed to capture a RAM dump before it was powered off, along with an encrypted disk. Your objective is to decrypt the drive. We get a chall.tar.gz Solving the challenge The tar.gz contains 2 files: an ELF and a raw: 1 2 3 drwxr-xr-x aurel/aurel 0 2026-03-09 16:46 files/ -rw-r--r-- aurel/aurel 1072693248 2026-03-09 16:46 files/disk.
Very happy to have won THCon CTF 2026 :)
All 5 of us were playing locally. The CTF had a few challenges only accessible locally, while others also accessible remotely.
We finished 1st on the local scoreboard, and also 1st on the "remote" scoreboard at the time of the end of the (local) CTF, but the remote CTF is still running, so that will change.
"A University in the US was hit 3 times by ransomware" (approximative quote) because they pay, get their data back, recover... But forget to patch, so they are hit by another instance.
Love this talk at THCon by Steph Shample.
#ransomware #infostealers #2026 #thcon
๐ Upcoming #infosec events in the next 14 days:
โข THCon #Thcon โ May 5-6, 2026, Toulouse ๐ซ๐ท #France
โข PIVOTcon #Pivotcon โ May 6-8, 2026, Malaga ๐ช๐ธ #Spain
โข BSidesLuxembourg @BSidesLuxembourg โ May 6-8, 2026, Belval ๐ฑ๐บ #Luxembourg
โข BsidesKerala #Bsideskerala โ May 7-9, 2026, Kerala ๐ฎ๐ณ #India
โข BSidesKent #Bsideskent โ May 8, 2026, Canterbury ๐ฌ๐ง #UK
Full list & calendar subscription โ https://xsa.github.io/infosec-events/
#cybersecurity #conference
๐ (continued)
โข BSidesBUD #Bsidesbud โ Apr 29, 2026, Budapest ๐ญ๐บ #Hungary
โข Zero Day Con #ZeroDayCon โ Apr 29, 2026, Dublin ๐ฎ๐ช #Ireland
โข Out Of The Box #OutOfTheBox โ Apr 29-30, 2026, Jakarta ๐ฎ๐ฉ #Indonesia
โข Security First Trinidad #SecurityFirstTrinidad โ Apr 30, 2026, Port of Spain ๐น๐น
โข THCon #Thcon โ May 5-6, 2026, Toulouse ๐ซ๐ท #France
โข PIVOTcon #Pivotcon โ May 6-8, 2026, Malaga ๐ช๐ธ #Spain
โข BSidesLuxembourg @BSidesLuxembourg โ May 6-8, 2026, Belval ๐ฑ๐บ #Luxembourg
In January/February, I had plenty of novel ideas around AI and CTFs.
I decided to wait and blog post after Ph0wn. Then, I decided to postpone again and blog post after our presentation at THCon with @virtualabs
I shouldn't have postponed. Now, there are many blog posts on this topic. We still have a few novelties to show ;P
but yes, the idea is that, with AI, when you've got an idea, you talk about it immediately. Or regret for ever :D
Good news:
- THCon prechal (teaser) is out: https://thcon.party/prechallenge/
- FCSC registration is out: https://fcsc.fr/
cryptax
๐
{Cyber,Info}Sec Events
Mathias Payer
jiska ๐ฆ