c0c0n is a 19 years old platform that is aimed at providing opportunities to showcase, educate, understand and spread awareness on Information Security, data protection, and privacy...
CTI Village is a volunteer-run, community-driven cybersecurity village focused on cyber threat intelligence, threat hunting, and defensive analysis. It provides a platform for threat intel practitioners, researchers, students, and enthusiasts to explore how threat data, IOCs, TTPs, and analytical tradecraft can be used to understand adversaries and improve real-world defense.
The village combines practical learning with interactive activities such as practitioner-led talks, hands-on workshops, deep-dive case studies, and open collaboration. The objective is to make cyber threat intelligence more accessible, while also encouraging participants to think creatively about attribution, hunting, tooling, and actionable defense.
At c0c0n 2026, you will find the following activities:
Practitioner-led sessions on threat intel, hunting, attribution, and analytical tooling, built around live demos and tool walkthroughs. These sessions offer practical insights into how threat intelligence is collected, analyzed, and operationalized.
IOC analysis, TTP mapping, and real-world case studies that move beyond basic indicators to actionable defense. Participants explore how to correlate data, map adversary behavior, and derive meaningful intelligence from raw threat data.
A space to trade notes, tools, and ideas with fellow analysts, students, and enthusiasts through informal discussions and show-and-tell. This track emphasizes community building, knowledge sharing, and peer learning across experience levels.
Put your investigative skills to the test with hands-on challenges in OSINT and threat intelligence. Follow clues, analyse evidence, and learn new techniques as you work towards the solution. Explore career paths in cyber threat intelligence and get practical guidance on skills, résumés, and interviews. Bring your questions, whether you’re taking your first steps or planning your next move.
9–10 October 2026 · Living Room, Grand Hyatt
Helping candidates interested in CTI with resume and career guidance.
Ransomware groups invest heavily in technical operational security. Brain Spider was no exception. What they failed to account for was their people. This paper presents findings from a sustained Human Intelligence operation conducted between 2021 and 2023 against the Brain Spider ransomware affiliate network.
A reverse-engineering investigation into a sextortion-themed malware campaign hiding a multi-revenue ecosystem, including multiple payloads and spam engines.
Crime Stoppers targets the human perpetrators behind cybercrime, not software vulnerabilities or security flaws, and seeks information about targets named in active Operation Silent Vector bounties.
A hands-on workshop on deploying autonomous AI Agents as research assistants to aggregate, analyze, and prioritize security blogs, research papers, and vulnerability disclosures.
Open discussion related to trends in CTI.
Adversary infrastructure is evolving rapidly. This session examines dynamic redirects, DNS abuse, cloud-hosted delivery layers, TDS chains, geofencing, DNS-based cloaking, infrastructure mapping, and practical defensive workflows.
Explores the shift from indicators and TTPs toward orchestration in AI-agent activity, using a 2026 OpenAI–Hugging Face incident as a visual investigation and building a practical AI-assisted CTI workflow.
A hands-on session on reading malware fingerprints and turning a single sample into intelligence about family relationships, related activity, and prior sightings.
Learn basics of Sigma rules used in Threat Hunting.
Reconstructs an investigation from a compromised GitHub repository through a malicious VS Code task, weaponized WOFF2 file, obfuscated JavaScript, an Ethereum-wallet dead drop, rotating C2 infrastructure, and DPRK-linked operations.
Helping candidates interested in CTI with resume and career guidance.
Open Discussion related to building CTI in your organization.
Together with organizations that support collaboration, innovation and a stronger cybersecurity community.
