Nicolas DIAZ
Nicolas Diaz is a cyber security enthusiast. He studied linguistics until 1995 before becoming passionate about the internet. Nicolas turned to webmastering, completely self-taught. In 1999, within the International Federation for Human Rights (FIDH), he was trained by a French Navy system and network engineer. He then worked for the FIDH NGO for more than 15 years, training human rights defenders and journalists from around the world to improve the security of their communications.
Nicolas Diaz is a fervent promoter of open source and free software as an ally of human rights defenders. He was a Community Manager for YesWeHack from 2016 to 2019, and from 2020 to December 2022 was in charge of cyber projects for R&D company DIATEAM in Brest. Since 2023 he is the Chief Information Security Officer at Reporters Without Borders.
Session
Behind the facade of modern Content Delivery Networks (CDNs) like Cloudflare, malicious threat actors frequently hide their true infrastructure to evade network-level scanning, block automated detection, and hinder attribution. Yet, even the most calculated psychological operations are prone to human error, and sometimes, effective threat hunting just requires a bit of luck. This presentation walks through a high-stakes, real-world investigation into an aggressive disinformation and smear campaign targeting the international press freedom organization Reporters Without Borders (RSF).
We demonstrate how standard Cyber Threat Intelligence (CTI) workflows combined with targeted Open Source Intelligence (OSINT) and a stroke of operational serendipity can completely tear down a CDN-backed defense.
Through a collaborative effort, two threat analysts (one from RSF Nicolas DIAZ and the other one Felix Aimé) successfully unmasked the origin web server of a malicious cybersquatted domain used to denigrate the NGO. Bypassing Cloudflare’s proxy allowed the team to map out the adversary’s broader digital footprint, leading directly to the technical attribution of (at least) one French communication agency. Attendees will gain a deep technical understanding of infrastructure tracking methodologies and witness how contemporary domestic influence operations, such as those executed by Progressif Media, are increasingly borrowing leaf-by-leaf from the psychological warfare and TTP manuals of notorious actors like the Wagner Group.