BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.hackfest.ca//hf2026//speaker//VZ7QWU
BEGIN:VTIMEZONE
TZID:EST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T070000Z
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T080000Z
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-hf2026-3P3WBK@cfp.hackfest.ca
DTSTART;TZID=EST:20261031T123000
DTEND;TZID=EST:20261031T132000
DESCRIPTION:A targeted loader campaign first appeared as an AirJaldi firewa
 ll-update lure\, then shifted delivery after responsible disclosure\, and 
 later reappeared as a Tibetan monastery archive and Dalai Lama teachings l
 ure. The Windows loader copied itself as `POWERFUL.exe`\, installed schedu
 led-task persistence\, fetched a large encrypted second stage from `blog.t
 ibetanmonasteries.com`\, and executed it in process memory. This talk walk
 s through the evidence chain: email headers\, static analysis\, Sysmon\, p
 caps\, Volatility\, x64dbg\, Ghidra\, and FLOSS. The final result is a rec
 overed 36.7 MB Go PE with Sliver-style capability strings and a runtime Re
 gister object containing `fish_tibet`.\n\nNote: AirJaldi is the ISP provid
 er in and around the city I stay.
DTSTAMP:20261014T080458Z
LOCATION:Track 1 (306B)
SUMMARY:From Disclosure to Re-Weaponized Delivery: Recovering a Go/Sliver-S
 tyle Implant from Memory - Sam
URL:https://cfp.hackfest.ca/hf2026/talk/3P3WBK/
END:VEVENT
END:VCALENDAR