Techcon25

Welcome to CSIT Technology Conference (TechCon) 2025!

CSIT proudly presents TechCon 2025 - a closed-door, by-invitation-only technical conference where the Singapore government and global industry cyber practitioners and experts converge.

In its 3rd annual edition, TechCon 2025 deep dives into the digitial defence domain. Guest speakers will adopt the lens of cyber adversaries to unveil novel, emerging attack tactics and trends. This intelligence provides an opportunity to strengthen defences.

TechCon 2025 is more than a conference. It brings together a community of practitioners and experts in digital defence where we have a unique opportunity to exchange insights, challenge assumptions and network with peers who are shaping the future of cyber resilience and innovation.

Morning Sessions

9:00 AM | Welcome Address

9:05 AM | Opening Address by Guest-of-Honour

9:15 AM | Keynote Address: Threats in the AI Era - The New Frontline of Attack & Defence

How is the threat landscape evolving, and what are actionable strategies for security teams, as new technologies impact threat activity? This presentation will first explore four key trends in current and emerging threats: threat actors leveraging security visibility gaps in specialised systems such as firewalls and virtualisation platforms; a persistent increase in zero-day exploitation for initial access; increasing presence of cloud-specific intrusion playbooks; and AI-driven acceleration of malicious operations in areas such as vulnerability research and code development. We will explore these trends in the context of multiple case studies of actors observed targeting local organisations. Next, this presentation will highlight several opportunities for action by security teams. We will explore how defenders can leverage AI capabilities to create an advantage; evolve security strategies to reflect an expanded attack surface; and disrupt threats through cross-organisational collaboration.

9:45 AM | Session 1: Through the Eyes of the Adversary - A Look at "Old" and "New"

Adversaries are evolving alongside enterprise technology and network defences - but some tactics never go out of style. This talk explores the tension between innovation and persistence in modern threat actor behaviour. Leveraging insights from Microsoft’s global threat intelligence, we’ll first examine how shifts in enterprise environments and the economics of network defence are driving changes in attacker strategy. Next, we will examine real-world events through technical case studies from the past year, including Forest Blizzard’s LLM-capable malware, state-sponsored campaigns involving SharePoint exploitation, Storm-0978’s curiously deceptive operations, and the continued use of software exploitation for initial access. The talk will highlight what’s new, what’s enduring, and what it all means for defenders going forward.

10:15 AM | Morning Break

10:45 AM | Session 2: Subliminal Poisoning - Understanding LLMs for a New Frontier in AI Security

LLMs are quickly being integrated into decision-making processes in traditional software applications, and LLM compromise will drive the next generation of security issues. However, today there are major gaps in the ability to identify and prevent security issues in LLM- based systems, because we don't fully understand how LLMs work or how they respond to stimuli. We will briefly overview AI Interpretability, explain how defenders can interpret LLMs to defend against attacks, and introduce a recently-identified structural weakness in LLMs that can only be found using the interpretability toolkit.

11:15 AM | Panel Discussion

Moderated by Chan Hwa Huei, Director, Mobile Security, CSIT

12:00 PM | Lunch

Afternoon Sessions

1:30 PM | Session 3

2:00 PM | Session 4: Hacking with AI - The Dark Side of Innovation

In this presentation, we uncover the groundbreaking yet unsettling role of AI in reshaping cyber warfare. As AI evolves at breakneck speed, it’s not just revolutionising industries—it’s empowering hackers to launch advanced cyber weapons at unprecedented efficiency. These tools drastically cut attack time, creating a new era of high-speed automated cybercrime, where the expertise once required is now in the hands of AI, making any beginner a world-class hacker.

We’ll dive into the underworld of AI-powered hacking, spotlighting WormGPT & FraudGPT, tools that emerged in mid-2023. Designed for malicious activities, these LLMs can generate undetectable malware, phishing campaigns, and exploit vulnerabilities with shocking ease. Through a demo, we’ll explore how this AI-driven technology is transforming the cybercriminal landscape and why it’s a wake-up call for all security professionals.

2:30 PM | Session 5: The Adversary is Evolving. Are We?

Drawing on 15 years of observing of the criminal underground, this session will provide a forward-looking analysis of significant shifts in the threat landscape. It will focus on two key trends: the migration of threat actors from traditional forums to other platforms, and the rapid weaponisation of AI to achieve unprecedented scale and sophistication. The goal is to shed light on what's next in adversary evolution and discuss the implications for defensive strategies.

3:00 PM | Afternoon Break

3:30 PM | Session 6: When AI Goes Rogue - The Real-world Implications of LLM Safeguard Bypasses

This session examines LLM safeguards and explores various circumvention techniques including prompt-based techniques and brain surgery-style bypasses. We will examine the potential cybersecurity threats and misinformation risks associated with these emerging vulnerabilities and discuss possible mitigation strategies to counter them.

4:00 PM | Session 7: Through the Attacker's Eyes - Living in Their World to Defend Our Own

Defenders often approach security like a chess match, while attackers overturn the rules entirely. This session offers an unfiltered look into attacker thinking, built on two decades of hands-on work in hacking, red teaming, exploit development, and intelligence gathering. Drawing on recent incident response cases, this session will highlight how intrusions are detected, missed, and traced back to their sources. Through demonstrations of real-world techniques and tools, the focus will remain on practical defense strategies and the enduring fundamentals that make the greatest difference.

4:30 PM | Session 8: Prompt Injection to Full Compromise - The Agentic AI Exploitation Chain

This session explores the evolving threat landscape of agentic AI systems, focusing on how seemingly isolated vulnerabilities can be chained into full-scale exploitation scenarios. We’ll walk through real-world techniques starting with LLM jailbreaks and prompt injection, leading to secret leakage and demonstrate how these can escalate into critical outcomes like endpoint RCE. Special emphasis will be placed on how tool poisoning in systems like MCP can serve as a launchpad for such attacks. This presentation aims to bridge the gap between AI-specific vulnerabilities and traditional exploitation logic, offering a practical lens for defenders and researchers alike.