CornCon_11 FRI-T1-9:00 - Lyle Kelly - The Current Threat Landscape Requires a Unique Approach

Vidair Labs Overview

Lyle Kelly presents threat landscape research from Vidair Labs, a nearly decade-old Idaho research wing. The lab has found nearly 200 original vulnerabilities—59% without CVEs—and runs about 2,000 curated sandbox detonations monthly, publishing free public dashboards.

Research Methodology

Capabilities include malware sandboxes, dark web monitoring via Tor, and adversary lab environments mimicking OT, medical, IoT, and enterprise IT deployments. Honeypots invite attackers so researchers can observe exfiltration and lateral movement behaviors.

Scale of Data Exposure

Kelly cites 1.3 billion individual records leaked to date and a 2.7 billion-record host-data breach from a compromised research firm later dumped free on the dark web after failed sale attempts.

Geographic Threat Trends

Contrary to assumptions, current data shows significant exfiltration originating from U.S. infrastructure, with Russia recently leading in some metrics. Attackers abuse global hosting to launch campaigns from unexpected locations.