BSides Canberra 2025

Decoding Threat Actors: a Free Tool for Mapping Aliases and Taming the Name Game
2025-09-25 , Main Track

Drowning in the chaos of Threat Actor aliases? Fancy Bear or Forest Blizzard? Wicked Panda or BRONZE ATLAS? And malware families? CageyChameleon or Cabbage RAT? Qakbot or Pinkslipbot?
In this session, we unveil a free tool designed to map across various Threat Actor naming conventions, malware families and public research. We’ll walk through how it works and highlight how it enables seamless searches of threat actors and associated research. It offers swift access to information on Threat Actors and malware families – an invaluable asset for your intelligence analysis, research, and operational tasks.

After earning his PhD in Mathematics, Dave dedicated the next 25 years to consulting for the Australian Government, focusing primarily on Defence, Intelligence, and Law Enforcement, before transitioning to roles at CrowdStrike and Gen Digital (which was formed from the merger of Avira, Avast, and NortonLifelock). Throughout his career, he has remained deeply involved in Incident Response and Forensics, with the privilege of supporting individuals during some of their most challenging moments at work.

His expertise spans the full spectrum of cybersecurity, from offensive and defensive operations to incident response and building security capabilities. He holds a strong passion for digital forensics and incident response, with a focus on helping people prevent and recover from attacks, and on removing obstacles to effective information sharing.