This session presents the forensic investigation and reverse engineering of a sophisticated remote-control system designed for stealth and persistence.

Learn how the attacker:

• Abused ARP packets to covertly deliver commands, bypassing traditional network detection.
• Used WebSockets for persistent, stealthy command and control.
• Turned Zoom into a Remote Access Trojan (RAT), auto-launching meetings and silently granting control.
• Executed commands using Python-based HID injection, emulating user behavior and evading logs.

Through technical breakdowns and a live demo, this session will expose never-before-seen malware techniques and provide actionable insights for defenders, threat hunters, and forensic teams on how to detect and mitigate these novel attack methods before serious damage occurs.