BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//hack-lu-2026//speaker//YXL7MH
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20251023T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:From the Rebellious Cities: Anatomy of a State-Aligned Espionage C
 ampaign - Eliad Kimhy
DTSTART;TZID=Europe/Luxembourg:20261023T114500
DTEND;TZID=Europe/Luxembourg:20261023T121500
DTSTAMP:20261009T050118Z
UID:pretalx-hack-lu-2026-3YMTRV@pretalx.com
DESCRIPTION:When protesters take to the streets\, someone is always watchi
 ng. CRESCENTHARVEST is a cyberespionage campaign that weaponizes Iran's on
 going civil unrest\, targeting Farsi-speaking supporters of the protest mo
 vement with carefully crafted lures. Victims receive what appears to be a 
 frontline dispatch from inside Iran: protest footage\, images from the str
 eets\, and a Farsi report from "the rebellious cities." Hidden inside are 
 two files that\, once clicked\, compromise the victim's machine through an
  attack chain so seamlessly crafted that they never suspect a thing.\n \nW
 hat unfolds beneath the surface is a sophisticated operation where trust i
 s the exploit and sympathy is the attack vector. This paper peels back the
  layers of a campaign designed to blend in\, stay hidden\, and steal every
 thing\, tracing the full attack chain\, the implant's capabilities\, and t
 he infrastructure fingerprints that tie it to a state-aligned actor with a
  long history of hunting its own people.
LOCATION:Europe
URL:https://pretalx.com/hack-lu-2026/talk/3YMTRV/
END:VEVENT
END:VCALENDAR