Daniel Ruiz, OPSWAT
Dani has had a passion for malware reverse engineering and threat intelligence research since college. He has worked as incident responder and threat intelligence research, but since the beginning of his career he has mainly focused on malware analysis for any role.
Currently, he combines threat research with malware analysis automation as threat research lead at OPSWAT's Metadefender Sandbox (also known as filescan.io). He loves chasing threat actors, tracking infection campaigns, and defeating the latest malware techniques in this never-ending whack-a-mole game against the threat actors.
OPSWAT
Session
Why have cybercriminals rely so heavily on .NET for malware development? This talk explores how .NET has quietly become one of the most abused languages or frameworks. With built-in support for dynamic compilation and in-memory execution, .NET offers attackers easy usage and flexibility for crafting modular, evasive malware. While existing .NET code is widely reused there is also a growing underground market of “Protector-as-a-Service” tools fueling the rapid adoption of .NET across cybercrime operations.
This talk dives into the internals of .NET from a malware analyst's perspective to later explore how protectors—far beyond simple packers—enable advanced evasion and anti-analysis techniques. We’ll show how this poses a unique challenge for sandboxes and automated pipelines, which fail to scale when facing threats that require deeper, context-aware analysis beyond basic runtime execution.
To ground this in the real world, we’ll analyze Roboski (also known as TicTacToe), a .NET bitmap-based loader that is simple, effective, and indeed everywhere. Despite being years old, it still sneaks under the radar and is widely reused in the wild, serving as a key delivery tool for next-stage payloads.
This talk will blend threat research with malware internals, sharing actionable techniques to improve detection and dive deep into what’s hiding inside today’s .NET malware.