DEF CON 34 – Main – C2YA Inside the Adversary’s Inbox – Vitaly Simonovich

85 findings exploitable from the internet with zero prior access. 28 takedown chains. Crypto failures that let you decrypt all C2 traffic with one recovered key.

Here’s how I got there. I’d been using coding agents to find bugs in software. Then I thought: what if I did this from the defender’s side, against the tools that threat actors actually use? I pointed LLM-assisted research at five C2 frameworks: Havoc, Mythic, Sliver, Covenant, AdaptixC2. Six months later, 251 design flaws, behavioral weaknesses, and vulnerabilities. Validated every finding in realistic lab environments. Then passively tapped 35 live servers via Shodan and Censys, and found operators running campaigns against victims in education, manufacturing, legal, and biotech across eight countries.

Eight bug classes recur across all five codebases. Findings rated on a defender-weighted scale, because CVSS doesn’t tell you which bug finds the server. Havoc, the most-deployed framework in the dataset, was archived on February 21, 2026. No patches coming. Defenders carry the load now.

AI isn’t just for protecting systems. Defenders can point it at the attackers’ own tools and find real ways to fight back. All findings for maintained projects disclosed through proper channels. Every demo against realistic lab environments I control.DEFCONConferenceRead More