{"id":66767,"date":"2026-09-16T12:37:32","date_gmt":"2026-09-16T10:37:32","guid":{"rendered":"https:\/\/www.secuinfra.com\/news\/bsides-frankfurt-2026-four-hours-on-the-trail-of-fancy-bear\/"},"modified":"2026-09-16T12:38:09","modified_gmt":"2026-09-16T10:38:09","slug":"bsides-frankfurt-2026-four-hours-on-the-trail-of-fancy-bear","status":"publish","type":"post","link":"https:\/\/www.secuinfra.com\/en\/news\/bsides-frankfurt-2026-four-hours-on-the-trail-of-fancy-bear\/","title":{"rendered":"BSides Frankfurt 2026: Four Hours on the Trail of Fancy Bear"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_87_1 counter-flat ez-toc-counter ez-toc-white ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">[inhalt_uebersetzt]<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.secuinfra.com\/en\/news\/bsides-frankfurt-2026-four-hours-on-the-trail-of-fancy-bear\/#Workshop_Fully_Booked_Hands-On_APT_Analysis\" >Workshop Fully Booked: Hands-On APT Analysis<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.secuinfra.com\/en\/news\/bsides-frankfurt-2026-four-hours-on-the-trail-of-fancy-bear\/#Strong_momentum_from_the_security_community\" >Strong momentum from the security community<\/a><\/li><\/ul><\/nav><\/div>\n\n<p class=\"wp-block-paragraph\">How do you uncover a cyberespionage attack that begins with a single phishing email? At BSides Frankfurt 2026, we addressed this question in a hands-on workshop with 25 participants. On September 10 and 11, the community conference at Goethe University Frankfurt brought security experts together to share knowledge. We were there with a fully booked workshop led by our DFIR specialist, Marius Genheimer.     <\/p>\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Workshop_Fully_Booked_Hands-On_APT_Analysis\"><\/span>Workshop Fully Booked: Hands-On APT Analysis<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n<p class=\"wp-block-paragraph\">Under the title <em>\u201cA Phishing Trip with Fancy Bear \u2013 Let\u2019s Analyze APT Malware Together!\u201d<\/em>, Marius walked the audience through the entire attack chain of a real-world case involving the Fancy Bear attack group, also known as APT28. This time, the session lasted four hours instead of the usual two.This allowed for more time to explore technical connections and delve deeply into the analysis on our own. <\/p>\n\n<p class=\"wp-block-paragraph\">In five chapters that built upon one another, the session covered everything from the background of the attacker group to the delivery of the malware and the exploitation of a vulnerability, all the way to establishing a persistent presence in the system and command-and-control communication. Participants worked directly with real artifacts: phishing email headers, a rigged RTF document, malware samples, and a C2 implant. <\/p>\n\n<p class=\"wp-block-paragraph\">The discussion then turned to specific details: How can relevant indicators be extracted from email headers? What role do manipulated Office documents and the CVE-2026-21509 vulnerability play? How do attackers use scheduled tasks, hide data in PNG files, or obfuscate strings using XOR and Base64? The analysis also covered the misuse of the open-source Covenant framework and trusted cloud services to disguise communications.   <\/p>\n\n<p class=\"wp-block-paragraph\">A specially developed interactive training platform accompanied the workshop. Quiz questions helped participants review their results and immediately see their progress. This made the workshop accessible even to less experienced participants. Using freely available open-source tools such as oletools and CyberChef, participants can also independently explore and deepen their understanding of the analytical methods taught.   <\/p>\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Strong_momentum_from_the_security_community\"><\/span>Strong momentum from the security community<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n<p class=\"wp-block-paragraph\">The rest of the program also impressed us with its diversity: presentations on hacking drones and electronic locks were complemented by sessions on Windows forensics and experiences with AI agents in the Security Operations Center. This combination of offensive and defensive perspectives made the event particularly exciting from a technical standpoint. The excellent organization provided the perfect setting for it.    <\/p>\n\n<p class=\"wp-block-paragraph\">We were particularly pleased with the positive feedback on the workshop. It serves as a strong incentive for us to make insights from the field of cyber defense understandable and practically accessible. Many thanks to the organizing team and all participants for a successful BSides Frankfurt 2026 and four intense hours of collaborative analysis!  <\/p>\n\n<figure class=\"wp-block-gallery has-nested-images columns-2 is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/signal-2026-09-11-08-58-28-752_002-1200x1600.jpg\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1200\" height=\"1600\" data-id=\"66755\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/signal-2026-09-11-08-58-28-752_002-1200x1600.jpg\" alt=\"\" class=\"wp-image-66755\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/signal-2026-09-11-08-58-28-752_002-1200x1600.jpg 1200w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/signal-2026-09-11-08-58-28-752_002-600x800.jpg 600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/signal-2026-09-11-08-58-28-752_002-768x1024.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/signal-2026-09-11-08-58-28-752_002-1152x1536.jpg 1152w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/signal-2026-09-11-08-58-28-752_002.jpg 1536w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-scaled.jpeg\"><img decoding=\"async\" width=\"1200\" height=\"1600\" data-id=\"66762\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-1200x1600.jpeg\" alt=\"\" class=\"wp-image-66762\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-1200x1600.jpeg 1200w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-600x800.jpeg 600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-768x1024.jpeg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-1152x1536.jpeg 1152w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-1536x2048.jpeg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/Unknown-2-1-scaled.jpeg 1920w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4430-scaled.jpg\"><img decoding=\"async\" width=\"1600\" height=\"1200\" data-id=\"66752\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4430-1600x1200.jpg\" alt=\"\" class=\"wp-image-66752\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4430-1600x1200.jpg 1600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4430-800x600.jpg 800w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4430-768x576.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4430-1536x1152.jpg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4430-2048x1536.jpg 2048w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4433-scaled.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"1200\" data-id=\"66751\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4433-1600x1200.jpg\" alt=\"\" class=\"wp-image-66751\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4433-1600x1200.jpg 1600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4433-800x600.jpg 800w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4433-768x576.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4433-1536x1152.jpg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4433-2048x1536.jpg 2048w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4434-scaled.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"1200\" data-id=\"66756\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4434-1600x1200.jpg\" alt=\"\" class=\"wp-image-66756\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4434-1600x1200.jpg 1600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4434-800x600.jpg 800w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4434-768x576.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4434-1536x1152.jpg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4434-2048x1536.jpg 2048w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4435-scaled.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"1200\" data-id=\"66748\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4435-1600x1200.jpg\" alt=\"\" class=\"wp-image-66748\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4435-1600x1200.jpg 1600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4435-800x600.jpg 800w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4435-768x576.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4435-1536x1152.jpg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4435-2048x1536.jpg 2048w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4431-scaled.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"1200\" data-id=\"66750\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4431-1600x1200.jpg\" alt=\"\" class=\"wp-image-66750\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4431-1600x1200.jpg 1600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4431-800x600.jpg 800w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4431-768x576.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4431-1536x1152.jpg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4431-2048x1536.jpg 2048w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4432-scaled.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"1200\" data-id=\"66753\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4432-1600x1200.jpg\" alt=\"\" class=\"wp-image-66753\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4432-1600x1200.jpg 1600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4432-800x600.jpg 800w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4432-768x576.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4432-1536x1152.jpg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4432-2048x1536.jpg 2048w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4429-scaled.jpg\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"1200\" data-id=\"66754\" src=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4429-1600x1200.jpg\" alt=\"\" class=\"wp-image-66754\" srcset=\"https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4429-1600x1200.jpg 1600w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4429-800x600.jpg 800w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4429-768x576.jpg 768w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4429-1536x1152.jpg 1536w, https:\/\/www.secuinfra.com\/wp-content\/uploads\/IMG_4429-2048x1536.jpg 2048w\" sizes=\"(max-width: 1600px) 100vw, 1600px\" \/><\/a><\/figure>\n<\/figure>\n","protected":false},"excerpt":{"rendered":"<p>How do you uncover a cyberespionage attack that begins with a single phishing email? At BSides Frankfurt 2026, we addressed this question in a hands-on session with 25 participants. On September 10 and 11, the community conference at Goethe University Frankfurt brought security experts together to share knowledge. We were there with a fully booked workshop led by our DFIR specialist, Marius Genheimer.     <\/p>\n","protected":false},"author":33,"featured_media":66766,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"dpc_author_order":[],"footnotes":""},"categories":[60],"tags":[774],"class_list":["post-66767","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-cybersecurity-trends-en-2"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts\/66767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/comments?post=66767"}],"version-history":[{"count":1,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts\/66767\/revisions"}],"predecessor-version":[{"id":66786,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts\/66767\/revisions\/66786"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/media\/66766"}],"wp:attachment":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/media?parent=66767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/categories?post=66767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/tags?post=66767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}