BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//hack-lu-2026//speaker//QMTNNV
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20251023T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Khmer Shadow: Uncovering a Targeted Cyber Espionage Campaign Again
 st Cambodian Military Intelligence - Subhajeet Singha
DTSTART;TZID=Europe/Luxembourg:20261023T080000
DTEND;TZID=Europe/Luxembourg:20261023T083000
DTSTAMP:20261009T050117Z
UID:pretalx-hack-lu-2026-BDL8U3@pretalx.com
DESCRIPTION:Acronis Threat Research Unit uncovered a new APT group\, track
 ed as Khmer Shadow\, behind two targeted cyber espionage campaigns against
  high-value Cambodian government institutions. One campaign confirmed spea
 rphishing of named personnel within the Information Collection Bureau (ICB
 ) of Cambodia's Ministry of National Defence\, the country's primary milit
 ary intelligence organ\, a rare instance of a threat actor directly target
 ing a Southeast Asian military intelligence bureau.\n\nAssessed with moder
 ate confidence as Chinese state-sponsored\, the actor used precision lures
  built around a fabricated Chinese development and investment persona\, wi
 th decoy documents referencing real named contacts inside the targeted bur
 eaus\, indicating prior reconnaissance and intelligence-driven targeting c
 onsistent with Chinese collection priorities in Southeast Asia.\n\nBoth ca
 mpaigns delivered a custom loader we have named NightForge\, which execute
 s a multi-stage infection chain culminating in a Havoc C2 agent. NightForg
 e reflects significant engineering investment: it neutralizes host securit
 y tooling before execution and stores an encrypted payload under a machine
 -specific filename within a legitimately themed staging directory to frust
 rate detection and cross-victim correlation.
LOCATION:Europe
URL:https://pretalx.com/hack-lu-2026/talk/BDL8U3/
END:VEVENT
END:VCALENDAR