Justin Borland
A proven technical leader in the security industry, Justin started his career with a Canadian Secret clearance while still in College. After graduating, he spent the next decade building custom packet capture systems, intrusion detection systems, logging systems, and DFIR tooling for large organizations.
Justin established and ran the Countermeasures team at Equifax. The team was responsible for building and maintaining the fleet of Moloch PCAP/IDS, IPS, and hundreds of other systems using petabytes of data. His team was also responsible for discovering the 2017 data breach. Justin was called into the Senate, while on paternity leave, in 2018.
At Barclays, Justin was part of the Global Hunt team and helped develop and mature many Threat Hunting capabilities and processes, especially related to malware analysis and DFIR.
Justin lead both the Threat Detection & Response and IT Ops functions at Unqork, a no-code/codeless-as-a-service company.
Currently, Justin is the Director of Threat Engineering at Abstract, and works with the Abstract Security Threat Research Organization (ASTRO) team to develop and implement threat detection content.
Despite always being a "Blue Teamer", Justin has documented CVEs in MISP and Qualys Cloud Agent, and actively contributes to open source technology, in addition to having open sourced a malware analysis platform (Phoenix).
Session
Thousands of commits hit public GitHub repositories every minute, and a meaningful slice of them are hostile: credential stealers, reverse shells, crypto drainers, and nation-state lures wearing the costume of a coding challenge. The same things that make GitHub great for developers (openness, trust, free hosting, a domain nobody blocks) make it excellent disposable infrastructure for attackers.
This talk is about what happens when you try to watch all of it. I'll walk through a pipeline that scans the public event stream in near real time, the deobfuscation engine that turns walls of XOR'd, packed, and base64'd gibberish back into something a detection rule can match, and the messy reality of keeping false positives low enough that a human analyst still trusts the queue. Then the fun part: who's actually out there, including DPRK-aligned crews running fake job interviews to backdoor developers at crypto firms. Much of the data is first triaged by an autonomous AI analyst turned loose on live adversary infrastructure from a throwaway VM.
You'll leave knowing how to build this visibility yourself, and why GitHub belongs in your threat model next to email and the browser.