Industrial Control Systems (ICS) and operational technology environments are high-value targets in modern cyber operations due to their role in managing critical industrial processes. Increased connectivity with enterprise networks expands the attack surface and enables threats that can impact both digital systems and physical operations.
This session presents an advanced approach to reverse engineering malware targeting industrial environments using execution flow reconstruction, runtime analysis, memory inspection, and operational context correlation. It focuses on malware interacting with OPC communication architecture and how adversaries abuse trusted industrial protocols to disrupt system coordination and process integrity.
Attendees will learn a defender-focused methodology covering staged execution behavior, injected process analysis, stealth runtime activity, payload chains, memory-resident execution, and cross-environment behavioral correlation. Decompiled execution paths are translated into structured visual models to improve understanding of complex behavior while maintaining analytical depth.
