ZeroNights

ZeroNights
Name	ZeroNights
Status	Active
Genre	Information security conference
Frequency	Annual
Location	Moscow (original), various
First	2011
Organizer	Divbrk / Positive Technologies (past), local security community

ZeroNights

ZeroNights is an annual information security conference focused on offensive research, vulnerability analysis, malware studies, exploit development, and security engineering. It attracts international speakers and attendees from the European Union, Russia, United States, China, India, Israel, Brazil, Japan, South Korea, Canada, United Kingdom and other countries, featuring technical talks, workshops, Capture The Flag competitions, and vendor exhibitions. The event sits alongside conferences such as Black Hat, DEF CON, RSA Conference, BruCON, Chaos Communication Congress, and Hack In The Box in the global security calendar.

Overview

ZeroNights serves as a forum for researchers, practitioners, and vendors in information security, cybersecurity, and network defense to present original work on exploits, reverse engineering, threat intelligence, and secure development. Speakers have come from organizations including Kaspersky Lab, Microsoft, Google, Facebook, Apple, Cisco, Symantec, Trend Micro, ESET, CrowdStrike, FireEye, Palo Alto Networks, Check Point Software Technologies, F-Secure, Fortinet, Splunk, Tenable, Rapid7, Qualcomm, Intel Corporation, AMD, IBM, Oracle Corporation, SAP SE, Red Hat, Canonical (company), SANS Institute, CERT/CC, ENISA, Europol, Interpol, MITRE Corporation, NCC Group, Mandiant, Akamai Technologies, Cloudflare, Okta, CyberArk, Zscaler and academic institutions such as Massachusetts Institute of Technology, Stanford University, University of Cambridge, University of Oxford, ETH Zurich, Tsinghua University, National University of Singapore, University of Toronto, University of California, Berkeley and Carnegie Mellon University. The program includes tracks comparable to those at Usenix, IEEE Symposium on Security and Privacy, ACM CCS, NDSS Symposium, and AsiaCCS.

History

ZeroNights was established in 2011 by security practitioners and organizers associated with firms such as Positive Technologies and local research groups to create a technical venue in Moscow and the wider region. Over time the conference expanded its scope, mirroring developments highlighted at Black Hat USA and DEF CON while intersecting with incident response themes seen at FIRST gatherings and sovereign cyber events like coverage after the Stuxnet and NotPetya incidents. Contributors and attendees have included analysts who previously worked at KrebsOnSecurity, The Hacker News, BleepingComputer, Wired, The Register, ZDNet, TechCrunch, Bloomberg News, Reuters, and technical teams from NATO CCDCOE and national CERTs such as CERT-EU.

Conference Program and Topics

Program topics at ZeroNights typically cover exploit techniques for Windows 10, Linux kernel, Android (operating system), iOS, macOS, IoT platforms, embedded systems, network protocols like TCP/IP, DNS, BGP, wireless standards including IEEE 802.11, and virtualization and cloud platforms such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform. Other program areas align with research streams at USENIX FAST, OASIS, IETF, and W3C on secure protocols and include container security (e.g., Docker), orchestration (e.g., Kubernetes), hardware security (e.g., ARM architecture, x86), cryptographic primitives referenced in NIST publications, privacy research comparable to work at PETs (Privacy Enhancing Technologies) Symposium and law- and policy-adjacent discussions echoing themes from Council of Europe and Wassenaar Arrangement debates. Workshops range from exploit development and reverse engineering to threat hunting and malware sandboxing, drawing practical skill-building reminiscent of HackMIT and CTFtime-listed events.

Notable Presentations and Research

ZeroNights has hosted presentations on advanced persistent threats, supply-chain compromises similar in scope to analyses of SolarWinds, kernel exploitation techniques akin to disclosures at Pwn2Own, and mobile platform exploits in the vein of research by Google Project Zero and Citizen Lab. Researchers have demonstrated zero-day exploitation chains, firmware attacks against UEFI and BIOS, side-channel attacks reminiscent of Spectre and Meltdown, fuzzing campaigns like those reported by AFL (American Fuzzy Lop), and reverse engineering of malware families comparable to Stuxnet, Flame, Duqu, Equation Group toolsets, and Emotet. Papers and demos have included advanced network intrusion detection methods paralleling Snort and Suricata research, machine learning adversariality comparable to work at NeurIPS and ICLR, and practical mitigations similar to those endorsed by CVE coordinators and vulnerability disclosure practices advocated by Bugcrowd, HackerOne, and Google Vulnerability Reward Program.

Organization and Sponsorship

The conference is organized by security professionals, local event teams, and corporate partners; past organizers and sponsors have included Positive Technologies, security consultancies, and technology vendors. Sponsors have come from companies like Microsoft, Kaspersky Lab, Cisco Systems, Intel Corporation, ARM Holdings, Google, Amazon.com, Oracle Corporation, IBM, SAP SE, Trend Micro, CrowdStrike, Palo Alto Networks, Check Point Software Technologies, Fortinet, F5 Networks, Qualcomm, Akami Technologies, Cloudflare, Akamai Technologies, Splunk, Tenable, Rapid7, Fidelis Cybersecurity, CyberArk, Okta, Zscaler, and regional firms. Partnerships have occasionally involved academic sponsors such as Moscow State University and research labs akin to NCC Group Research.

Attendance and Community Impact

ZeroNights attracts security researchers, exploit developers, malware analysts, system administrators, CTOs, CISOs, policy advisors, students, and journalists, similar to attendee mixes at Black Hat USA, DEF CON, RSA Conference, CanSecWest, and BlueHat gatherings. The event has fostered local and regional talent pipelines, influenced vulnerability disclosure practices coordinated with MITRE Corporation and CVE Program, and contributed to open-source tooling used by projects like Metasploit Framework, Ghidra, Radare2, IDA Pro, Binwalk, Volatility (software), Wireshark, Burp Suite, Nmap, and OpenVAS. Community outcomes include collaborations that intersect with national cyber exercises like those run by NATO, policy briefings seen by European Commission stakeholders, and technical training that feeds into incident response teams at CERT-UK, CERT-FR, and other national teams.

Category:Computer security conferences