April 11 - 17, 2026

Cybersecurity Week

Hosted by Department 41,
National Research Nuclear University
MEPhI (Moscow Engineering Physics Institute)
About the Event

Dear colleagues!


We invite you to participate in the traditional CyberFox Applied Cybersecurity Week, organized by the MEPhI Department of Cryptography and Computer Systems Security and the MEPhI Institute of Intelligent Cybernetic Systems, with the participation of Kaspersky Lab. The event will be held from April 11 to 17, 2026, in a combined in-person and remote format.


The 2026 event will be dedicated to the 35th anniversary of the MEPhI Department of Cryptography and Computer Systems Security. On the final day of the event, April 17, the awards ceremony for the winners and runners-up of the All-Russian Student Olympiad in Cryptography and Computer Security, CryptoFox 2026, will take place.

Speakers

CyberFox Cybersecurity Week is a unique opportunity to meet renowned speakers. In 2026, the event will once again be international, opening with a lecture by a professor from the University of Applied Sciences of Western Switzerland (HES-SO). The Week will also offer the opportunity to attend lectures by leading experts from the Computer and Information Security departments of the Russian Technical University MIREA and the Cryptography and Computer Systems Security department of the National Research Nuclear University MEPhI, as well as leading employees of Kaspersky Lab and Positive Technologies.

  • Anna Melekhova

    Software architect and systems engineer with a passion for performance and security. Spent over 10 years working on virtual machine kernels, followed by five years focused on distributed services architecture. For the last five years, have been working on Kaspersky OS security. Have taught at MIPT and Innopolis, and have prepared over 50 students for their dissertations.

  • Roland Sako

    Roland is a lecturer at the University of Applied Sciences Western Switzerland, teaching courses on networks, Java, cybersecurity, and fuzzing. He previously spent seven years as a security researcher with Kaspersky ICS CERT in Geneva, collaborating with the Moscow-based team. Roland co-founded Winsl0w.io, an educational cybersecurity initiative. He holds a master’s degree in legal aspects, cybercrime, and information security from the University of Lausanne, with a focus on mobile forensics.

  • Sergey Temnikov

    A cybersecurity researcher with a strong passion for vulnerability discovery, he specializes in identifying and analyzing security issues in Java and PHP applications, focusing on complex and critical vulnerabilities.


    He currently works at Kaspersky and previously held positions at SEC Consult and Amazon, gaining extensive experience in both corporate and consulting environments.


    His primary research focus is fuzzing methods, which he uses to discover previously unknown vulnerabilities in modern software systems. In his spare time, he actively participates in bug bounty programs, continually honing his skills and contributing to improving global security.

  • Nikolay Frolov

    Information security researcher with over ten years of experience. During this time, worked at Advanced Monitoring and Kaspersky Lab, and currently conducting research at Positive Technologies. His primary focus is hardware reverse engineering and industrial control system (ICS) security. He also teach the course "Introduction to Reverse Engineering" at Department 41 of the Moscow Engineering Physics Institute (MEPhI).And have presented at PHDays, Insomnia Hack, Kaspersky ICS Conf, and other relevant conferences.

  • Tatiana Kurmasheva (crytech7)

    Information security and penetration testing specialist

    with over 7 years of experience in red teams, R&D, and automation. Focuses on offensive security research, consulting, and secure application architecture design.

  • Ilya Pugachev

    Ilya is a graduate of Bauman Moscow State Technical University’s Information Security Department (IU-8). He currently lectures at RTU MIREA’s Department of Computer and Information Security. His interests include electronics, circuit design, and low-level programming for security applications.

  • Dmitry Shelkunov

    PhD in Engineering, co-founder and CTO of Recrypt, reverse engineer, AI specialist, and author of the Recryptorium AI platform for file analysis. He has held leading roles in projects in the field of DRM and automated reverse engineering using AI. In total, he has worked for approximately 20 years on obfuscation, white-box cryptography, deobfuscation, malware analysis, and AI. He has published several publications in international peer-reviewed journals and participated in international conferences.

Programme
11 April 19:00
Team Color: Black — A Primer on Physical Penetration Testing
Roland Sako, Lecturer, HES-SO
Software vulnerabilities get patched. Physical ones often don't. This talk offers a gentle introduction to black teaming — testing security beyond the network, at the physical layer. We'll cover what physical assessments are, why they matter, and how they connect to traditional cyber auditing. Topics include:
· The relationship between physical and logical security
· Audit vs. Penetration tests
· Reconnaissance methods
· Objects of interest: access control, surveillance, entry points
· Vulnerability chaining and attack routes
13 April 19:00
CosmicSting: One of the Biggest E-Commerce Vulnerabilities Disclosed – Discovery, Demonstration, and Security Impact
Sergey Temnikov, Principal Security Researcher, Kaspersky
The bug bounty program was created to improve security worldwide. However, due to a chain of failures, a single discovered vulnerability has turned into one of the largest attacks on e-commerce applications, affecting 75% of Adobe Commerce stores. Hacks are occurring at a rate of 3 to 5 stores per hour. This attack is known as CosmicSting (CVE-2024-34102). As the researcher who discovered it, I will present all the details of this PHP vulnerability, show a live proof-of-concept demonstration, and raise questions about security gaps at all stages—from initial discovery to the widespread spread of the problem..
14 April 19:00
From a child's toy to an electric charging station: three stories about how IoT devices are failing us
Nikolay Frolov, Expert, Positive Techologies
In this talk, I'll discuss three completely different IoT devices I've researched. Each can be purchased in a regular store, and each offers subtle opportunities for attackers.

I'll start with a children's toy—a smart robot with video conferencing. The manufacturer has simplified interaction with the cloud to such an extent that you can even contact your child through the official app. I'll also show you what kind of personal information parents are leaking along with this.

The second story is about a printer. For some reason, manufacturers here are more concerned with protecting cartridges from counterfeiting than with the security of the firmware itself. I'll explain what you can find inside if you dig into the updates, and what consequences this leads to.

The third is about a home charging station for an electric car. I'll show you how insecure BLE turns your backyard electrical outlet into a public one, and who ends up paying for it.

Three stories, one problem: security in smart devices remains a weak point.
15 April 19:00
How to develop a secure operating system?
Anna Melekhova, Senior Security Architect, Kaspersky
We'll discuss how to write a system that's not so easy to hack. We'll build a workflow from secure-by-design to hardening and the SDL process. We'll try to understand the differences between them. We'll discuss why secure-by-design alone can't protect against an attacker and why a hundred hardenings are no substitute for a good architecture. We'll discuss general practices for developing secure software and delve into the beautiful, low-level world of operating systems. Our ultimate goal is to understand why CVEs are constantly being found in Linux, but it's not that scary.
16 Апреля 17:30
When we talk about AI, we mean data, or why data is more important than algorithms.
Dmitry Shelkunov, PhD, CTO "Recript"

The IT industry is currently experiencing a real boom from the development and widespread adoption of AI. The creators of virtually every IT product claim that it incorporates AI. This trend hasn't bypassed the world of information security. However, there's a crucial question that's been floating around but rarely addressed: where do all these people get the data they need to properly train their AI models? How do they process the data? Or are they using ready-made, pre-trained open-source models? Or are AI models trained on open datasets? And how high-quality are open datasets? I'll share our experience collecting datasets to train our AI file classifiers and why collecting datasets is a complex and technologically advanced process. I'll explain the downsides of open datasets and why many of them are only suitable for academic research, and not always even then. I'll explain why it's necessary to develop and train your own models when "everything is on GitHub" and there are LLMs that "can do it all."

16 Апреля 19:00
From Firmware to Cloud: A Security Audit of Commercial Service Robots
Tatiana Kurmasheva, Independent Researcher

Commercial service robots have already become a part of everyday life, but they are not just smart home appliances; they are full-fledged IoT platforms with OTA updates and a cloud-based management infrastructure. This architecture makes them particularly interesting from an offensive security perspective. In this report, we will demonstrate how to approach auditing such systems and present the results of a security study on a commercial service robot.

17 April 17:30 (in person at MEPhI)
Do reverse engineers need to know circuit design?
Ilya Pugachev, Senior Lecturer, RTU MIREA
There's an old joke about how many programmers it takes to change a light bulb. And the answer is: none, it's a hardware problem. Or you're talking to a customer:
- We're handing you the firmware.
- Excellent! And when will you hand over the device?
- Why do you need it? Can't you just look at the firmware itself?

This report is dedicated to those cases where firmware analysis would be unsuccessful without knowledge of circuit design.
Contacts:
cryptofox@mephi.ru