BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//hack-lu-2026//talk//KQCEEC
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20251021T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Cloak and Filter: Weaponizing the GPU and Windows Cloud Filter for
  File-less Execution and Privilege Escalation - David Shandalov
DTSTART;TZID=Europe/Luxembourg:20261021T173000
DTEND;TZID=Europe/Luxembourg:20261021T180000
DTSTAMP:20261009T054055Z
UID:pretalx-hack-lu-2026-KQCEEC@pretalx.com
DESCRIPTION:Security solutions have long since established absolute contro
 l over disk I/O and user-land memory. Every step you take\, you generate t
 elemetry. To survive\, attackers need to operate where EDRs and other solu
 tions cannot see. However\, most attack surfaces include touching the disk
  or RAM\, triggering monitored disk writes or creating suspicious memory a
 llocations. \n\nThis talk introduces a novel attack surface that bypasses 
 this barrier by weaponizing the Windows Cloud Filter and its API (CFAPI). 
 Although CFAPI was originally designed for cloud storage providers\, we ab
 use it to bridge the gap from untouchable memory space of the GPU directly
  to the attacking Cloud Provider.\n\nWe will demonstrate how our 0-byte fi
 le placeholders can achieve PE while not triggering a single event on a fu
 lly patched Windows 11 machine. Compute Shaders will decrypt the payload e
 ntirely on the GPU\, completely bypassing traditional monitoring.\n\nAtten
 dees will learn how to conduct low-level attack surface research\, observi
 ng all the steps we went through. The obstacles of our research journey wi
 ll be noted so the audience will learn from our mistakes. The undocumented
  structures and flows of the attack surface will be shown and dissected. A
 ttendees will walk away from this talk with enough knowledge and ideas to 
 continue where this research left off.
LOCATION:Europe
URL:https://pretalx.com/hack-lu-2026/talk/KQCEEC/
END:VEVENT
END:VCALENDAR