74th TF-CSIRT Meeting: Full Programme

Trainer: Gregor Wegberg

Full day training: 09:00 – 17:00

This training is designed to empower the community with the knowledge and skills necessary to prepare for, respond to, and mitigate the impact of ransomware attacks. With a strong focus on real-world application, the session will delve into key aspects of ransomware, proactive defense measures, incident response, and recovery strategies.

Trainer: Claudiu Chelaru

Half day trainings, two deliveries:

• 09:00 - 12:30
• 13:00 - 17:00

When 600 apartment buildings in Ukraine lost heating during a harsh winter, the culprit wasn’t missiles – it was malware. FrostyGoop, a lesser-known but exploited OT threat, was designed to disrupt industrial control systems using ModbusTCP. This malware had one mission: manipulate a specific controller to cause real-world impact. In this session, we’ll unpack how the malware was identified, how its behavior was analyzed, and what we learned from dissecting it. More importantly, we’ll highlight how you can improve detection strategies for these focused, purpose-built threats using anomaly detection, open-source threat intelligence, and behavioral indicators.

In short, we’ll take a deep dive into FrostyGoop OT malware, validating IoCs, examining ModbusTCP functions it supports, analyzing targeted ENCO controllers via OSINT, parsing malware config JSON and examining samples. We’ll explore reverse engineering its core, building enhanced detection strategies, and applying anomaly detection using YARA rules and network traffic analysis.

Trainers: Maria Edblom Tauson, Anne-Marie Achrenius

Half day training: 13:00 - 17:00

We want to offer a table top exercise including a basic introduction to crisis exercises and crisis management. We are ending the training with a lessons learned session.