BSides Berlin 2026

What does a real APT attack look like when you don’t just consider it theoretically, but analyze it yourself step by step? At BSides Berlin 2026, we’ll do just that: In our interactive, hands-on workshop “A Phishing Trip with Fancy Bear – Let’s Analyze APT Malware Together!” we’ll take participants on a technical journey through Fancy Bear ’s (APT28/GRU) attack chain—from the initial phishing attempt to command-and-control communication.

Using real-world artifacts, we’ll work together to examine phishing email headers, a rigged RTF document, malware samples, and a C2 implant. A custom-developed interactive training platform guides you through five sequential chapters: Threat Actor Background, Payload Delivery, Exploitation, Persistence & Installation, and Command & Control. Integrated analysis exercises and quiz questions make insights and progress immediately visible—practical, easy to follow, and suitable even for beginners in APT analysis.

Technically, we go into great detail: We extract Indicators of Compromise from email headers, analyze tampered Office documents and MIME type mismatches, examine the misuse of OLE/COM objects in connection with CVE-2026-21509, and track persistence techniques ranging from file staging and scheduled tasks to LSB steganography in PNG files. Using CyberChef, we decrypt simple XOR and Base64 obfuscation and use the Covenant C2 framework as an example to demonstrate how attackers exploit legitimate open-source tools and trusted cloud services for their operations, thereby blending into seemingly normal network traffic.

All of the tools used and demonstrated in the workshop—including oletools, CyberChef, and Covenant —are free and open source. This means the analysis methods presented can be directly applied in your own security practice. The workshop offers a tangible look at the traces left behind by modern APT campaigns—and how these can be systematically investigated—especially for organizations looking to further develop their detection and response capabilities.

We look forward to helping shape BSides Berlin 2026 and, together with the community, delving deeply into the analysis of a sophisticated APT attack.