LSU Cyber Lecture Series

Do You See What I See? : A Year of ICS Slopcode LSU Cyber Lecture Series Do You See What I See? : A Year of ICS Slopcode From Knock to Shield: Open-Source Intelligence and Honeypots Join Jimmy Wylie, malware analyst at Dragos, Inc., for an evidence-driven look at whether AI is making it easier for criminals to disrupt critical infrastructure. Drawing on an analysis of approximately 30 samples of ICS malware and attack tools developed with large language models, explore what these tools reveal about the real-world risks to power grids, water systems, and other industrial environments. From samples linked to the Mexican government breach to tools such as ZionSiphon and BlackNova, discover what the evidence tells us about AI’s capabilities, the evolving threat landscape, and the gap between alarming headlines and demonstrated threats to industrial control systems. Free and open to all! ABSTRACT Will AI teach the average criminal to take down a power grid or poison a water supply? Media headlines and the Frontier AI companies say yes. But evidence is what matters, so our team pulled apart about 30 samples of attempted industrial control system (ICS) malware and other attack tools written with large language models (LLMs). Our sample set included malware from the Mexican government breach, ZionSiphon, BlackNova, and other tools advertising themselves as “advanced SCADA hacking.”In this talk, we’ll use 5 of those malware samples to show you what the LLMs get right, and what they get very wrong. You will come away understanding what LLMs have and have not changed for malware developers writing tools targeting industrial systems. This talk is for anyone who wants to better understand LLMs and their implications for cybersecurity. While we use malware as an example, no malware analysis or reverse engineering experience is required to understand this talk. The talk will close with a Q&A. SPEAKER BIO Jimmy Wylie is a malware analyst at Dragos, Inc., focused on threats to critical infrastructure. He was the lead analyst on several landmark cases, including PIPEDREAM—the first ICS attack utility belt; TRISIS—the first malware to target safety instrumented systems; and the analysis of historical artifacts from CRASHOVERRIDE—the first malware designed to disrupt breakers and switchgear in electric transmission substations. With over 15 years of experience in reverse engineering and malware analysis, Jimmy has worked with multiple DoD contractors, applying skills in network analysis, memory forensics, and malware detection to counter national-level adversaries. He later developed and taught malware analysis courses to civilian and military professionals nationwide. Jimmy has presented at SANS ICS Summit, DEF CON, and RECON, sharing insights on ICS malware analysis and threat group capabilities. Outside of work, he enjoys board games, crossword puzzles, and testing the limits of his library card. Find him on LinkedIn, Mastodon (@[email protected]) and BlueSky (@mayahustle.com).