Type: Security & Threats

This session with Maria Olavella, Senior Crime Intelligence Analyst with the Florida Department of Law Enforcement's Cyber Crime Division, dives deep into the psychology, history, and operational patterns of dark markets. From the template laid out by the original Silk Road to the dead-drop delivery mechanics of Hydra and the recent takedown of Archetype, Maria explains how law enforcement tracks pseudonymous threat actors who think they are invisible.

Gary Vano of the Florida Department of Law Enforcement (FDLE) breaks down why the blockchain is a nightmare for criminals trying to hide their tracks. While bad actors attempt to use "bureaucratic violence" to overwhelm law enforcement with complex webs of transactions, FDLE’s CyberFAST team uses advanced data patterns to map out entire laundering ecosystems.

This session explores how modern attackers bypass hardened environments by exploiting human behavior, identity systems, misconfigurations, and overlooked attack paths rather than relying solely on traditional malware. Travis Weathers walks through real-world offensive security techniques used during red team engagements, demonstrating how organizations that appear secure on paper can still be compromised through credential abuse, social engineering, privilege escalation, weak operational processes, and gaps in visibility across cloud and identity infrastructure. Topics include adversary simulation, phishing resistance, lateral movement, MFA bypass techniques, detection blind spots, identity-focused attacks, operational security failures, and the importance of thinking like an attacker when designing defensive strategies. The session emphasizes practical lessons organizations can apply immediately to strengthen resilience, improve detection capabilities, and close the gaps attackers most commonly exploit.

This session explores the growing cybersecurity risks within modern software supply chains and how organizations can reduce their open-source attack surface through more secure containerization and dependency management practices. The speaker examines major supply chain attacks including SolarWinds, Log4j, and the XZ Utils backdoor, showing how vulnerabilities in open-source dependencies and build systems continue to impact organizations at scale. Topics include software bills of materials (SBOMs), container security, CVE management, dependency sprawl, supply chain trust, multi-stage container builds, minimal container images, FIPS validation, STIG compliance, reproducible builds, and secure release pipelines. The presentation also demonstrates how hardened “built-from-source” container approaches can dramatically reduce vulnerabilities, improve compliance readiness, and minimize operational overhead for development and security teams managing modern cloud-native infrastructure.

This session explores practical, low-cost approaches organizations can use to strengthen cybersecurity incident response capabilities without large security budgets or dedicated enterprise tooling. The speakers walk through the full incident response lifecycle using the NIST framework, covering preparation, detection, containment, eradication, recovery, and post-incident analysis, while highlighting free and accessible resources available through CISA. Topics include building incident response plans, maintaining asset inventories, security awareness training, phishing simulations, threat intelligence feeds, tabletop exercises, vulnerability scanning, logging and monitoring tools, recovery planning, and documenting lessons learned. The presentation also demonstrates how small teams and public-sector organizations can leverage free CISA services, cyber hygiene assessments, tabletop exercise packages, and performance goal frameworks to improve readiness, resilience, and coordination during cyber incidents.

This session explores how single sign-on (SSO) platforms and SaaS providers have become a major target for modern cybercriminals. The speaker breaks down how ransomware groups like Scattered Spider and ShinyHunters use sophisticated social engineering, voice phishing (“TOAD” attacks), fake SSO portals, and MFA bypass techniques to compromise organizations through help desk impersonation and real-time phishing kits. Topics include SaaS security risks, identity-based attacks, device code phishing, lookalike domains, cloud data exposure, logging challenges with SaaS providers, and the growing importance of monitoring third- and fourth-party risk. The presentation also examines practical defenses including phishing-resistant MFA, passkeys, DNS monitoring, employee awareness, and stronger visibility into cloud environments and SSO activity.

This session explores the growing reality that ransomware recovery is no longer just a backup problem — it’s a data integrity problem. The speaker examines how modern ransomware attacks target backups directly, use AI-driven tactics to evade detection, and dramatically extend recovery timelines for organizations of every size. Topics include cyber resiliency, the NIST Cybersecurity Framework, AI-powered ransomware detection, clean recovery strategies, data integrity validation, and the operational challenges organizations face when recovering from large-scale attacks. The presentation also highlights how AI is being used defensively to identify corruption patterns, detect compromised recovery points, and help organizations recover faster with confidence.            

A thought-provoking session exploring how AI is transforming cybercrime from isolated attacks into a scalable service economy. The speaker breaks down the rise of identity-state theft, scam compounds, AI-driven fraud, deepfakes, and cybercrime-as-a-service, while examining how trust, identity, and human behavior have become the new battlegrounds in modern cybersecurity. Practical insights include zero trust architecture, detecting trust anomalies, protecting against social engineering, and understanding the growing role of data brokers and organized cybercrime infrastructure.