BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Shapeshifting C2: Applying DAITA Traffic Shaping to 
 Defeat DPI\n   and DLP Detection\n   Tags: Red Team Village | Misc\n   Whe
 n: Friday\, Aug 7\, 13:00 - 13:59 PDT\n   Where: LVCCW Level 1 Hall 1 309 
 (Red Team Village) Workshop Stage 1 -\n   [1]Map\n\n   Description:\n\n   
 ML-based DPI and DLP solutions have made signature evasion\n   insufficien
 t. Modern enterprise detection analyzes packet size\n   distributions\, in
 ter-packet timing\, and burst patterns to fingerprint\n   C2 traffic regar
 dless of how well headers and TLS certificates are\n   spoofed.\n\n   This
  talk demonstrates how three techniques from the VPN privacy\n   research 
 space - originally developed to defeat traffic analysis\n   against Tor an
 d Mullvad\, can be adapted for offensive C2 operations:\n\n     1. \n\n   
     Constant-size packet morphing: forcing all frames to a fixed\n       M
 TU-aligned size removes the packet-size fingerprint that ML\n       classi
 fiers depend on\;\n\n     2. \n\n       Cover traffic injection: dummy pac
 kets sent at Poisson-distributed\n       or adaptive intervals make real b
 eacon timing statistically\n       invisible\;\n\n     3. \n\n       Proba
 bilistic pattern distortion: Maybenot-inspired state machines\n       inje
 ct cover bursts alongside real packets\, destroying\n       recognizable C
 2 sequences\;\n\n   We then will see how layering these techniques with ap
 plication-layer\n   malleable profiles (traffic impersonating Microsoft Gr
 aph\, Slack\, or\n   Okta) and bonus: indirect transports like cloud stora
 ge dead-drops\n   (S3\, OneDrive) creates C2 channels that defeat detectio
 n at every\n   layer simultaneously - behavioral\, flow\, and application.
 \n\n   Attendees leave with a concrete mental model for building evasion\n
    stacks that go beyond header manipulation.\n\n   SpeakerBio:  Rafael Fe
 lix\, Offensive Security Lead at Hakai Offensive\n   Security\n\n   Rafael
  has been working with malware development for 5 years\, also\n   being in
 volved in the malware community for more than 7 years. He is\n   also expe
 rienced in Incident and Response\, specifically during malware\n   inner w
 orkings analysis. Currently\, Rafael is a researcher for Hakai\n   Offensi
 ve Security (https://hakaisecurity.io/research-blog)\, being\n   deeply in
 volved with red-team operations.\n\n   '\n\n   1. #LVCCW_Level1_Hall1\n\n\
 n
DTEND:20260807T205900Z
DTSTART:20260807T200000Z
LOCATION:Red Team Village - LVCCW Level 1 Hall 1 309 (Red Team Village) Wor
 kshop Stage 1
SUMMARY:Shapeshifting C2: Applying DAITA Traffic Shaping to Defeat DPI and 
 DLP Detection
END:VEVENT
END:VCALENDAR