About me

Rintaro Koike / 小池 倫太郎

Rintaro Koike

小池 倫太郎

Rintaro Koike is a security researcher at NTT Security (Japan) KK, specialising in threat research and malware analysis. He is also the founder of ‘nao_sec’, where he leads threat research initiatives. His work focuses on web-based threats and APT campaigns targeting East Asia. He has delivered more than 30 presentations at over ten international conferences, including Virus Bulletin, Botconf, FIRST and AVAR.

Positions

  • Security Researcher

    NTT Security (Japan) KK, 2019–present

  • Security Engineer

    NEC Corporation, 2018–2019

Community Activities

Education

  • BSc in Sciences

    Meiji University, 2018

    Graduating Class Representative - Delivered a speech at the graduation ceremony on behalf of the undergraduate cohort.

Honours and Awards

Conference Presentations

  • Otter encyclopaedia: deep analysis of Otter family VB 2026, Sevilla, [Abstract]
  • Unshelling VShell at Scale TROOPERS 26, Heidelberg, [Abstract]
  • Attic Shinobi: Persistent Listening for Adversary Fingerprints CARO Workshop 2026, Innsbruck, [Abstract]
  • Tracing the Origin: Fingerprints in MSC File for Clustering and Attribution AVAR 2025, Kuala Lumpur, [Abstract]
  • Stealth over TLS: the emergence of ECH-based C&C in ECHidna malware VB 2025, Berlin, [Abstract], [Slide], [Paper]
  • Broken Seals, Broken Trust: Flaws and Defences in the Certificate Ecosystem FIRST Annual Conference 2025, Copenhagen, [Abstract], [Slide]
  • Anti Confiture: An Otter Has A Sweet Tooth SINCON 2025, Singapore, [Abstract]
  • Behind the scenes of recent DarkPlum operations JSAC 2025, Tokyo, [Abstract], [Slide]
  • P-wave of malicious code signing VB 2024, Dublin, [Abstract], [Slide], [Paper]
  • IcePeony with the ‘996’ work culture VB 2024, Dublin, [Abstract], [Slide]
  • Unmasking DarkPlum: inside the operations of DPRK’s elite cyber espionage group VB 2024, Dublin, [Abstract]
  • Rebrand to X?: SteelClover Cornucopia AVAR 2023, Dubai, [Abstract]
  • The rise of malicious MSIX file Hack.lu 2023, Luxembourg, [Abstract]
  • FirePeony: A ghost wandering around the Royal Road VB 2023, London, [Abstract], [Slide]
  • The rise of malicious MSIX file SANS APAC DFIR Summit 2023, Tokyo, [Abstract]
  • GroundPeony: Crawling with Malice HITCON CMT 2023, Taipei, [Abstract], [Slide]
  • Detection engineering with Sigma: Defend against APT targeting Japan JSAC 2023, Tokyo, [Abstract], [Slide]
  • Into The Silent Night Botconf 2022, Online, [Abstract], [Paper]
  • An Order of Magnitude Update Japan Security Analyst Conference 2022, Online, [Abstract], [Slide]
  • Operation Software Concepts: A Beautiful Envelope for Wrapping Weapon CODE BLUE 2021, Online, [Abstract], [Slide]
  • Where is the cuckoo egg? VB 2021, Online, [Abstract], [Slide], [Paper]
  • Operation Software Concepts: A Beautiful Envelope for Wrapping Weapon Kaspersky Security Analyst Summit 2021, Online, [Abstract]
  • When you gaze into the Bottle,… Japan Security Analyst Conference 2021, Online, [Abstract], [Slide]
  • Operation LagTime IT: colourful Panda footprint VB 2020, Online, [Abstract], [Slide], [Paper]
  • Unveiling the CryptoMimic VB 2020, Online, [Abstract], [Slide], [Paper]
  • An Overhead View of the Royal Road CPX 360 (CPRCon) 2020, New Orleans, [Abstract], [Slide]
  • An Overhead View of the Royal Road Japan Security Analyst Conference 2020, Tokyo, [Abstract], [Slide]
  • A Chronicle of Fallout AVAR 2019, Osaka, [Abstract], [Slide]
  • nao_sec tools AVTOKYO 2019, Tokyo, [About]
  • Finding drive-by rookies using an automated active observation platform VB 2019, London, [Abstract], [Slide]
  • Finding Treasures in the ToyBox HITCON CMT 2019, Taipei, [Abstract], [Slide]
  • 週末なにしてますか? 忙しいですか? DbDを解析してもらっていいですか? Japan Security Analyst Conference 2019, Tokyo, [Abstract], [Slide]
  • 日本からExploit Kitはどのように見えるのか？ SECCON Conference 2018, Tokyo, [Abstract]
  • EKTotal BlackHat USA 2018 Arsenal, Las Vegas, [Abstract], [Slide]
  • Drive-by Download Must Die Japan Security Analyst Conference 2018, Tokyo, [Abstract], [Slide]

Blog Posts / White Papers

Copyright © Rintaro Koike