BSides Frankfurt 2026

On September 10 and 11, 2026 BSides Frankfurt brings together the cybersecurity community at Goethe University Frankfurt. The community conference is known for its technical depth, open exchange of knowledge, and practical security insights, and we’ll be there with our own hands-on workshop.

A Phishing Trip with Fancy Bear – Let’s Analyze APT Malware Together!

Friday, September 11, 2026 | 2:00 p.m. | Room 1

How does a targeted phishing attack unfold, from the initial contact to active command-and-control communication? In Marius Genheimer’s beginner-friendly, hands-on workshop, participants will trace the entire attack chain of a realistic Fancy Bear campaign (APT28/GRU) —step by step and using real artifacts.

Using a custom-developed interactive training platform , we work together to analyze phishing email headers, a weaponized RTF document, malware samples, and a C2 implant. Five chapters that build on one another cover everything from the threat actor’s background to payload delivery, exploitation, and persistence, all the way through to installation and command & control. Integrated quizzes immediately highlight progress in analysis and ensure that even complex attack techniques remain easy to understand.

In this technical deep dive, we’ll show you, among other things, how to extract Indicators of Compromise from email headers, detect tampered Office documents and MIME type mismatches, and investigate OLE/COM object abuse related to CVE-2026-21509. We’ll analyze persistence techniques such as file staging and scheduled task abuse, uncover LSB steganography in PNG files, and decrypt simple XOR and Base64 obfuscation using CyberChef.

In addition, we take a look at how professional threat actors misuse legitimate open-source technologies, such as the Covenant C2 Framework, and leverage trusted cloud services to conceal malicious communications within normal network traffic. For security professionals in particular, this analysis provides a very concrete illustration of the challenges modern cyber defense teams face in detecting sophisticated attacks.

Best of all: The tools used and demonstrated in the workshop—including oletools, CyberChef, and Covenant —are free and open source. This means the analysis methods shown can be immediately understood, replicated, and applied to your own security practices.

Wir freuen uns auf Sie.