Security Analyst Summit

A significant part of the SAS program over the years has been devoted to presenting the results of new investigations into cyberattacks and APT groups.

• Careto (“The Mask”). In 2014, Kaspersky reported on the Careto campaign (also known as The Mask), which targeted Spanish-speaking countries. Kaspersky first publicly presented information about Careto at the SAS conference in Punta Cana.^[7] The attack reportedly lasted for many years and affected government and energy structures in more than 30 countries. Researchers noted that Careto was one of the most sophisticated cyber espionage operations.^[8]
• Equation Group. In 2015, the GReAT team presented an analysis of the attacks and malware used by the Equation Group, one of the most advanced APTs. Equation used malware at the hard drive firmware level and attacked hundreds of computers in dozens of countries. The report on Equation caused significant attention in the professional community and the media.^[9]
• Carbanak. In 2015, Kaspersky researchers, in collaboration with law enforcement agencies, uncovered the Carbanak cybercriminal group, which defrauded about 100 banks around the world. Information about the attacks was presented at SAS in Cancun in 2015, including details of theft operations totaling up to $1 billion. It was proven that the attackers infected corporate bank networks and made unauthorized money transfers.^[10]
• De-anonymization of hackers. In 2015, research was presented at SAS on the de-anonymization of cybercriminals through analysis of their online behavior. Recorded Future showed how attackers, even those using Tor, left so many traces on the internet that they could be linked to real people. In particular, by analyzing common data leaks from attackers, Recorded Future showed that information about former hackers, including email addresses and passwords, was easily found in open sources.^[11]
• Moonlight Maze. The historic Moonlight Maze operation (late 1990s) was again the subject of analysis at SAS in 2016. A new investigation presented by Professor Thomas Reed linked the well-known Moonlight Maze operation to modern attacks by the Turla group.^[12] Moonlight Maze was one of the first identified cyber campaigns, likely sponsored at the state level (it attacked the Pentagon, NASA, and U.S. energy facilities), and its study served as the basis for understanding modern threats.^[13]
• Attack via CCleaner. In 2018, the Avast team presented a report at SAS on the results of its investigation into the compromise of the CCleaner utility. Experts discovered the ShadowPad backdoor in the CCleaner developers' infrastructure and presented details in a report at SAS in Cancun. The attack affected millions of users, and the report revealed technical details of the campaign, including links to the Axiom group (presumably associated with APT17).^[14]
• Data leaks via multi-scanning services. Representatives of Swisscom AG spoke about security threats arising from the fact that confidential data (personal, government, official, commercial) ends up in malware scanning services. Such services have effectively become repositories of sensitive business data, creating a new class of risks for corporate security.^[15]
• Vulnerabilities in robotics. Research by the MalCrawler team at SAS 2018 demonstrated security issues in industrial robotic systems: many industrial robots use outdated operating systems (e.g., Windows XP) and control systems that are accessible by default without a password, and robot control programs remain “open” to hacking. As a result, industrial facilities are vulnerable to “emergency shutdown” attacks (e.g., Triconex/Triton).^[16]
• ShadowHammer. In 2019, Kaspersky Lab uncovered the ShadowHammer supply chain attack: malicious code was embedded in official ASUS Live Update updates and delivered to 500,000–1,000,000 computers, with the attack specifically targeting approximately 600 systems. Analysis showed a high level of preparation for the operation using compromised ASUS digital certificates.^[17] Kaspersky's findings were also confirmed by Symantec.
• Operation Triangulation. A sophisticated spy attack on iOS devices using multiple zero-day vulnerabilities. Known cases of compromise cover the period from 2019 to 2024. Triangulation software allowed spies to gain complete control over victims' iPhones without interacting with the user. A description of this scheme and the hardware vulnerabilities used appeared in reports by Kaspersky and a review by Dark Reading. Journalists noted that Triangulation bypassed most of the iPhone's security mechanisms by relying on undocumented OS and hardware features. The research was presented at SAS in Thailand in 2023.^[18]
• Malware disguised as crypto games. In 2024, Kaspersky GReAT experts uncovered a sophisticated campaign by the Lazarus group, in which malware was distributed under the guise of a crypto game. According to the study, the attackers exploited users' interest in crypto assets and gaming projects to infect systems and subsequently conduct surveillance. Analysts noted the high level of concealment and the multi-stage nature of the attack.^[19]
• New spyware from Hacking Team. In 2025, researchers recorded the use of Dante spyware tools linked to the Italian company Memento Labs, which emerged during the reorganization of Hacking Team. The campaign exploited a zero-day vulnerability in Chrome.^[20]

Charlie Miller & Chris Valasek

Renowned automotive security researchers. They spoke at the Kaspersky Security Analyst Summit in 2016.^[21] Their presentation focused on vulnerabilities in the Jeep Cherokee's Uconnect system that allowed researchers to remotely hack into the vehicle.

Katie Moussouris

American computer security researcher, creator of Microsoft's bug bounty program, founder of Luta Security. She spoke at SAS about the right ways to build the bug bounty program.^[22]

Bruce Schneier

Internationally recognized cryptography, cybersecurity and public policy expert. He gave a keynote speech at SAS and participated in a discussion with Baroness Pauline Neville-Jones, former Minister of State for Security of the United Kingdom, on civil liberties and government cyber intelligence.^[23]

Eva Galperin

Eva Galperin, Director of Cybersecurity at the Electronic Frontier Foundation (EFF), spoke at the Kaspersky Security Analyst Summit (SAS) in 2018. Her presentation focused on research into a suspected state-sponsored Lebanese hacking group known as Dark Caracal.^[24]

Matt Tait

A researcher in the field of cyber threats and malware analysis, former GCHQ employee, and Google hacker. In 2018, he gave a keynote speech on the topic of disinformation in the general cyber threat landscape.^[3]