Rintaro Koike / 小池倫太郎

Rintaro Koike is a security researcher at NTT Security (Japan) KK, specialising in threat research and malware analysis. He is also the founder of ‘nao_sec’, where he leads threat research initiatives. His work focuses on web-based threats and APT campaigns targeting East Asia. He has delivered more than 30 presentations at over ten international conferences, including Virus Bulletin, Botconf, FIRST and AVAR.

■ Links

Email
Twitter
- kkrnt
GitHub
- koike
LinkedIn
- Rintaro Koike

■ Experiences

NTT Security [Sep 2019 ~ Present]
- Security Researcher
  - APT research targeting East Asia
- Security Analyst
  - Malware analysis
  - Network/EDR log analysis
NEC Corporation [Oct 2018 ~ Aug 2019]
- Security Engineer
  - Threat intelligence analysis
  - Product security incident response
  - Penetration testing

■ Research

2026

VB 2026
- Otter encyclopaedia: deep analysis of Otter family [Abstract]
TROOPERS 26
- Unshelling VShell at Scale [Abstract]
CARO Workshop 2026
- Attic Shinobi: Persistent Listening for Adversary Fingerprints [Abstract]

2025

AVAR 2025
- Tracing the Origin: Fingerprints in MSC File for Clustering and Attribution [About]
VB 2025
- Stealth over TLS: the emergence of ECH-based C&C in ECHidna malware [Abstract] [Slide] [Paper]
FIRST Annual Conference 2025
- Broken Seals, Broken Trust: Flaws and Defences in the Certificate Ecosystem [Abstract] [Slide]
SINCON 2025
- Anti Confiture: An Otter Has A Sweet Tooth [Abstract]
JSAC 2025
- Behind the scenes of recent DarkPlum operations [Abstract] [Slide]

2024

VB 2024
- P-wave of malicious code signing [Abstract] [Slide] [Paper]
- IcePeony with the ‘996’ work culture [Abstract] [Slide]
- Unmasking DarkPlum: inside the operations of DPRK’s elite cyber espionage group [Abstract]

2023

AVAR 2023
- Rebrand to X?: SteelClover Cornucopia [Abstract]
Hack.lu 2023
- The rise of malicious MSIX file [Abstract]
VB 2023
- FirePeony: A ghost wandering around the Royal Road [Abstract] [Slide]
SANS APAC DFIR Summit 2023
- The rise of malicious MSIX file [Abstract]
HITCON CMT 2023
- GroundPeony: Crawling with Malice [Abstract] [Slide]
JSAC 2023
- Detection engineering with Sigma: Defend against APT targeting Japan [Abstract] [Slide]

2022

Botconf 2021/2022
- Into The Silent Night [About] [Paper]
Japan Security Analyst Conference 2022
- An Order of Magnitude Update [Abstract] [Slide]

2021

CODE BLUE 2021
- Operation Software Concepts: A Beautiful Envelope for Wrapping Weapon [Abstract] [Slide]
VB 2021
- Where is the cuckoo egg? [Abstract] [Slide] [Paper]
Kaspersky Security Analyst Summit 2021
- Operation Software Concepts: A Beautiful Envelope for Wrapping Weapon [About]
Japan Security Analyst Conference 2021
- When you gaze into the Bottle,… [Abstract] [Slide]

2020

VB 2020
- Operation LagTime IT: colourful Panda footprint [Abstract] [Slide] [Paper]
- Unveiling the CryptoMimic [Abstract] [Slide] [Paper]
CPX 360 2020 (CPRCon 2020)
- An Overhead View of the Royal Road [Abstract] [Slide]
Japan Security Analyst Conference 2020
- An Overhead View of the Royal Road [Abstract] [Slide]

2019

AVAR 2019
- A Chronicle of Fallout [Abstract] [Slide]
AVTOKYO 2019 (Event)
- nao_sec tools [About]
VB 2019
- Finding drive-by rookies using an automated active observation platform [Abstract] [Slide]
HITCON CMT 2019
- Finding Treasures in the ToyBox [Abstract] [Slide]
Japan Security Analyst Conference 2019
- 週末なにしてますか? 忙しいですか? DbDを解析してもらっていいですか? [Abstract] [Slide]

2018

SECCON 2018 Conference
- 日本からExploit Kitはどのように見えるのか？ [Abstract]
BlackHat USA 2018 Arsenal
- EKTotal [Abstract] [Slide]
Japan Security Analyst Conference 2018
- Drive-by Download Must Die [Abstract] [Slide]

■ Awards

マルウェア対策研究人材育成ワークショップ MWS 2020 貢献賞 [About]
令和2年サイバーセキュリティに関する総務大臣奨励賞 [About]
2019年度 JNSA賞特別賞 [About]
マルウェア対策研究人材育成ワークショップ MWS Cup 2017 総合2位 [About]
コンピュータセキュリティシンポジウム 2017 CSS2017学生論文賞 [About] [Slide]
セキュリティキャンプ・アワード 2017 最優秀賞 [Slide]
マルウェア対策研究人材育成ワークショップ MWS Cup 2016 総合2位 [About]
マルウェア対策研究人材育成ワークショップ MWS Cup 2015 優勝 [About]

■ Certifications

NTT Group Security Principal

■ CVEs

CVE-2025-24054
- Microsoft, Windows, NTLM Hash Disclosure Spoofing Vulnerability

■ External Activities

nao_sec [Feb 2017 ~ Present]
- Founder & Chief Researcher
マルウェア対策研究人材育成ワークショップ MWS
- 実行委員 [2021]
- 企画委員 [2020]
- 問題作成支援員 [2019]
セキュリティ・キャンプ全国大会
- 講師 [2021]
- NOC ベテランOB [2018]
- NOC チューター [2017]
Japan Security Analyst Conference
- Review Board [2023 ~ 2026]

Rintaro Koike / 小池 倫太郎

■ Links

■ Experiences

■ Research

2026

2025

2024

2023

2022

2021

2020

2019

2018

■ Awards

■ Certifications

■ CVEs

■ External Activities

■ Blogs & White Papers

Rintaro Koike / 小池倫太郎