Open Registrations: CSIRT Forum and MISP Workshop 2026

Material for the 2026 Lectures 14th Brazilian CSIRTs Forum 7th MISP Workshop Also check: 2026 Photos on Flickr 14th CSIRTs Forum 7th MISP Workshop Event summary in press release Location 2026 Amcham Business Center Rua da Paz, 1431 Chácara Santo Antônio, São Paulo/SP. On-site parking available. Single daily fee: R$40.00 Registration Each event has its own registration, and it is necessary to have an account on the NIC.br Courses and Events Portal. Registrations closed on July 20th. The event is free. Agenda 14th Brazilian CSIRTs Forum July 28 and 29, 2026 Times subject to change. TLP markings are indicated in the agenda for reference. Always respect the TLP on the speaker's slide and on the event room screens. See here for details on the use of TLP at the event Day 1 - July 28, 2026 Ivo de Carvalho Peixinho, Federal Police TLP:CLEAR SLIDES The presentation will detail how to build an automated malware analyzer using free tools like IDA Free, Ghidra, JADX, APKtool, and others, interconnected via vscode or opencode with local or cloud LLM models. At the end, real examples of reports created using the tool from real campaigns like Grandoreiro, Sorvepotel, Eternidade Stealer, among others, will be shown. Matheus Moura, Apura Cybersecurity Intelligence TLP:CLEAR SLIDES Incidents involving the exposure of personal data are usually treated as isolated events, limited to the moment of the leak or the improper publication of information. However, practical experience demonstrates the existence of a subsequent and often neglected operational layer: the structured reuse of this data by illicit querying panels. These clandestine environments consolidate multiple sources of information, exposed historical databases, compromised credentials, improper integrations, and automated querying mechanisms, converting scattered data into immediate operational capability. For incident response teams, the phenomenon imposes a new challenge: to respond not only to the original leak but also to the continued and operationalized use of the exposed information. The goal is to expand the traditional reading of data incidents, demonstrating that, in many cases, the initial event does not end the problem, it only inaugurates its most exploitable phase. Henrique Shinki Kodama, FEBRABAN TLP:CLEAR TLP:AMBER+STRICT SLIDES All post-mortem analysis reveals more about detection than about the attack itself. This lecture presents the lessons learned from the post-mortem analysis of a ransomware incident, focusing on the investigation of server logs and records. The presentation covers the reconstructed path from the analysis, highlighting opportunities for early detection, visibility gaps, and practices that can strengthen the incident response posture for other security teams. Edney Fernandes, Amazon Bank TLP:CLEAR SLIDES The lecture proposes a technical and operational approach to using NetFlow/IPFIX to support cybersecurity and incident response in financial institutions, considering the requirements of CMN Resolutions No. 5.274/2025 and BCB No. 538/2025. The objective is to show how network flow telemetry can complement controls such as firewall, SIEM, EDR, IDS/IPS, NDR, proxy, and logs, helping SOC, CSIRT, network, infrastructure, and security teams answer essential questions in investigations, such as who communicated with whom, when, via which port, with what volume, and in which direction. The presentation relates the use of NetFlow to topics such as traceability, network protection, segmentation validation, identification of undue connections, monitoring of critical environments like Pix, STR, and RSFN, detection of atypical traffic, and incident response support. Two hypothetical practical scenarios will also be presented: a suspicious external connection made by a production server outside of business hours and an undue attempt at direct communication with a critical environment. The content will have technical, objective, and accessible language, focusing on practical application for professionals involved in security and incident response. Tiago Neves, Vinícius Azevedo, and Guilherme Ochsendorf, Opice Blum TLP:CLEAR SLIDES The presentation will address how high-impact financial incidents have stopped relying exclusively on complex technical vulnerabilities (such as zero-days) to exploit a chain of structural, architectural, and business rule failures. The content will bring an analysis of the main root causes identified in real forensic investigations, duly anonymized, including the exposure of hardcoded credentials, the absence of Multi-Factor Authentication (MFA) in critical systems, failures in separation of duties (SoD), supply chain compromise (insecure DevOps), and insider recruitment. The objective is to provide the audience of the 14th Brazilian CSIRTs Forum with practical lessons in defense, response, and the importance of integrating technical-legal governance, demonstrating how traceability (logs) and rapid response shape legal and regulatory risk before bodies like the ANPD and the Central Bank. Andrews Leal Moraes, Israelita Hospital TLP:CLEAR TLP:AMBER SLIDES The increase in the volume of personal data stored by organizations and the growing regulatory pressure associated with the protection of this information make the ability of incident response teams to investigate events involving potentially undue access to sensitive data increasingly relevant. For CSIRT teams, one of the main challenges is distinguishing legitimate activities from anomalous behaviors in complex environments, where authorized users may access large volumes of information as part of their operational functions. This presentation discusses a methodological approach for investigating events involving sensitive data, combining incident response practices (CSIRT), digital forensic investigation (DFIR), and impact assessment from the perspective of data protection. Practices to reduce false positives, improve incident prioritization, and structure specific playbooks for investigations involving access to sensitive information will also be discussed. Finally, lessons learned related to the evolution of incident response processes and the integration between information security teams and data protection programs will be shared. André Torres Breves Gonçalves, TCU TLP:CLEAR SLIDES The lecture addresses the paradigm shift in modern cyberattacks, where adversaries no longer "hack" systems but instead use valid credentials to gain unauthorized access. The central focus is on mitigating risks associated with the management of privileged accounts (such as weak, static, or shared passwords), demonstrating how to implement a robust and low-cost Zero Trust architecture using Open Source tools. Marlon Fabro, Globo TLP:CLEAR SLIDES This lecture discusses what CTI is, including the difference between data, information, and intelligence, and the CTI lifecycle. The role of CTI in the organization, the essential competencies of a CTI analyst, what is produced and for whom, and the maturity levels of the CTI-CMM Model are also discussed. Atila Santos, Charles Lima, and Grazielle Alessa, Bitcoin Market TLP:CLEAR TLP:GREEN SLIDES The massive adoption of generative AI in organizations expands the attack surface and introduces risks that do not fit into traditional incident response models. The challenge is no longer purely technical: how to enable the use of AI at scale, with efficiency, without compromising security and business continuity? In this presentation, we demonstrate how the Bitcoin Market CSIRT structured a secure AI adoption approach based on risk, operational efficiency, and scale. The approach combines defining risk limits with implementing specific workflows for handling AI-related incidents and protecting associated models and data. We also explore the use of AI itself as an ally in security, enhancing triage, analysis, and automation processes, as well as the mechanisms adopted to maintain governance and operational control without hindering innovation. Finally, we share practices adopted, challenges faced, and lessons learned throughout the journey. Cristine Hoepers, CERT.br/NIC.br TLP:CLEAR SLIDES Over the last decade, there has been an express growth in the number of CVEs registered. This increase is the result of several factors, including more effective code analysis tools, more complex systems, and greater interest from attackers in these systems. In contrast, the community has also matured, and standards have been created for identifying supply chain components, assigning severity, and prioritizing vulnerabilities. The AI tools recently made available have further shortened the time between a vulnerability discovery and a functional exploit being available. This scenario makes it crucial for organizations to quickly identify their level of exposure and the risk of being or having been compromised. This lecture will discuss how organizations can use existing standards to perform risk-based vulnerability management, covering not only operational systems and market applications but also internally developed software and the entire dependency chain. Join us in this relaxed time accompanied by "food and drinks". Make new contacts, catch up with old colleagues, and exchange ideas with the speakers. Day 2 - July 29, 2026 Jamilson Ramos Evangelista, Anatel TLP:CLEAR SLIDES This lecture presents Anatel's action in combating the mass use of infected pirate decoders, associated with the BadBox 2.0 malware. It demonstrates how these devices, widely distributed on the network edge, are exploited as vectors for botnet formation, fraud execution, and distributed attacks. The lecture highlights the operational challenges faced by CSIRTs, including low visibility, CGNAT usage, and distributed infrastructure. Practical strategies for detection, mitigation, and coordinated response, as well as lessons learned and recommendations applicable to the community are discussed. Marcos P. Miranda de Souza, CTIR Gov TLP:CLEAR SLIDES The increase in the complexity and number of cyber incidents in the scope of the Federal Public Administration (APF) creates challenges for standardizing and the effectiveness of incident and response communication and communication with their respective audiences. In this regard, this lecture presents the incident communication processes executed by the Government Cyber Incident Response Center (CTIR Gov) during the 2025 to 2026 period, emphasizing the structuring, automation, and direction of communication. As a descriptive organization, the Lasswell communication model – "who says what, by which channel, to whom, and with what effect" – will be used. Valdenir Júnior, Fernando Ebrahim, and Ulisses Jardim, TRE-TO TLP:CLEAR TLP:GREEN TLP:RED SLIDES Vulnerability management in institutional environments faces a recurring challenge: the volume of findings often exceeds the operational capacity of the teams responsible for analyzing and handling them. This lecture presents the experience of the Regional Electoral Court of Tocantins (TRE-TO) in the evolution of its vulnerability prioritization process and how it began incorporating references like KEV (Known Exploited Vulnerabilities) and EPSS (Exploit Prediction Scoring System) into its prioritization logic, seeking greater alignment between operational decisions and actual risk. The criteria adopted, the adaptation of these concepts to the institution's existing tool, the construction of operational queries, data extraction automation, and integration with decision support dashboards will be presented. This is an applied and operational account, aimed at organizations that need to make practical decisions in the face of concrete constraints of time, personnel, and remediation capacity. André Ricardo Landim, CAIS / RNP TLP:CLEAR TLP:GREEN SLIDES Managing the attack surface remains a major challenge for security teams. In dynamic and distributed environments, organizations often lack continuous visibility of the services exposed within their own addressing space. This presentation introduces the initial results of the ARGUS project in RNP, an initiative focused on improving the visibility of assets exposed in the network infrastructure. The project uses the IVRE framework to collect, index, and analyze data related to the exposed attack surface, combining it with other open source components to enable continuous scanning, historical analysis, and large-scale data processing. The presentation demonstrates how active scan data, when collected and analyzed continuously over time, can be transformed into actionable intelligence to support Blue Team, SOC, CSIRT, and Threat Intelligence operations. Paulo Matheus Nicolau Silva, CEPESC TLP:AMBER+STRICT One of the main objectives of the analysis stage in the incident response process is not just pointing out the extent of the damage, but enabling security improvements in various aspects, such as organizational, vulnerability correction, network architecture changes, threat detection processes, tool usage optimization, and others. This lecture will bring an analysis of a real ransomware case, with the aim of demonstrating that from each finding, a learned lesson or missed detection opportunity can be reversed into improvements to prevent future incidents. Zoziel Freire, Telefônica Brasil S.A. (Vivo) TLP:CLEAR SLIDES This lecture explores the evolution of ransomware from the perspective of a continuous arms race between attackers and defenders. Instead of analyzing only ransomware techniques or only defense tools, the presentation shows how each advance in attack techniques forces an evolution in defense strategies, and how new detection capabilities lead attackers to develop increasingly sophisticated evasion methods. Ransomware has ceased to be just a type of malware. Today, it represents a highly adaptable criminal ecosystem, constantly evolving in response to improvements in corporate defenses. In the current scenario, the ransomware battlefield is no longer defined only by who executes the malware, but also by who has greater visibility and response capability in the compromised environment. Alencar Silva and Luiz Jussen, Soow Sigma TLP:CLEAR TLP:RED SLIDES The lecture aims to present a practical view, based on real incident response cases, on how the threat landscape has evolved with the combination of social engineering, credential compromise, abuse of development environments, misuse of API keys, ransomware-as-a-service, and inappropriate use of artificial intelligence agents. Luiz Eduardo Paes Salomão, Federal Civil Police (PCDF) TLP:AMBER+STRICT TLP:RED SLIDES Despite the fact that corporate endpoint defenses are increasingly mature, Initial Access Brokers (IABs) continue to inundate the dark web with valid credentials. The explanation for this fact lies in a silent, massive vector operating outside the control of SOCs: the contamination of personal devices is facilitated by content-sharing platforms like YouTube. In this presentation, we move from theory and open the data from a recent empirical study focused on mapping the supply chain of Infostealers distributed in YouTube videos. We demonstrate, with real data and artifacts collected in the field, how these campaigns operate a true "industrialization of cybercrime." The presentation will address the practical dilemma of who handles incidents: how to respond to a corporate compromise when the "patient zero" is the employee's unmanaged (personal) machine? The lecture will provide operational insights to improve risk-based triage, integrate threat intelligence from these campaigns into active identity defense, and adapt incident response playbooks to a reality where infections happen without generating a single alert in the company's EDR. Ednaldo Sousa and Rodrigo Tiago de França Silva, CSIRT Núclea TLP:CLEAR TLP:AMBER+STRICT TLP:RED We will present the exploitation of legitimate processes in administrative departments as an attack vector, focusing on real scenarios, such as responding to official requests and demands in the Legal department. The presentation will reinforce the posture that technical support and incident response teams (CSIRT/Help Desk) should adopt in urgent situations, especially when dealing with seemingly valid demands, but potentially exploited by malicious agents. The objective is to promote a practical and applicable view, connecting process, technology, and people, to reduce the operational risk associated with the exploitation of legitimate administrative flows. 7th MISP Workshop July 30, 2026 Times subject to change. TLP markings are indicated in the agenda for reference. Always respect the TLP on the speaker's slide and on the event room screens. See here for details on the use of TLP at the event 7th MISP Workshop – July 30, 2026 Beyond Sharing: Integrating MISP into Security Operations Luciano Righetti, MISP Development Team / CIRCL Simultaneous Spanish/Portuguese/Spanish Translation TLP:CLEAR SLIDES This practical tutorial, delivered by a member of the MISP Development Team, shows how to integrate the MISP platform with security operations tools, such as Wazuh, Zeek, and Suricata. In addition to these integrations, the tutorial will also cover workflows and how to curate IoCs before integrating them with the other tools. Beyond Sharing: Integrating MISP into Security Operations Luciano Righetti, MISP Development Team / CIRCL Simultaneous Spanish/Portuguese/Spanish Translation Thiago Cesar and Ismael Rocha, Vision Cybersecurity TLP:CLEAR TLP:AMBER+STRICT SLIDES Honeypots allow observing real attacks on the internet and collecting valuable data about malicious activities. However, transforming this data into actionable intelligence is still a challenge for many organizations. In this presentation, we demonstrate how data collected by honeypots can be processed, enriched, and transformed into structured Indicators of Compromise (IOCs). We will show a practical approach to integrating this information into MISP, allowing for intelligence sharing between security teams and CSIRTs. The lecture will present real examples of collected attacks, as well as the process of transforming these events into intelligence usable for detection, correlation, and defense. Mailson Ribeiro Santos and Ulisses de Sá Alencar and Moraes, SERPRO TLP:CLEAR SLIDES Intelligence sharing is motivated by different objectives, including real-time incident response, post-incident analysis, and strategic intelligence production. However, this process presents significant challenges, such as the presence of sensitive data, the risk of leakage, and the lack of trust between organizations. In this context, sharing without control can be as harmful as the absence of sharing, highlighting the need for structured approaches. This lecture presents the use of MISP by SERPRO and shows that the efficient use of MISP depends not only on its technological adoption but also on the integration between processes, automation, and governance, reinforcing that intelligent threat sharing requires a structured, secure, and value-oriented approach. Cleber Soares, Owasp and Vision Cybersecurity TLP:CLEAR SLIDES This lecture presents a practical approach to enriching Threat Hunting using MISP and Maltego, integrated with multiple sources such as SIEM, malware sandboxes, and external Threat Intelligence feeds. The flow includes the initial collection of artifacts from proactive Threat Hunting activities or alerts generated by SIEM solutions, followed by the enrichment and correlation of indicators (IOCs) in MISP. This data is expanded with sandbox analysis and validation from external sources, allowing for greater context and reduction of false positives. Maltego is used for pivoting and visual analysis of relationships between indicators, enabling the identification of malicious infrastructures and attack patterns. Based on this correlation, threat hunting techniques oriented by intelligence are applied to actively search the environment. Finally, the results support response and mitigation actions, including blocking controls such as Firewall, IDS/IPS, and WAF.