The Péter Szőr Award aims to recognise the best piece of technical security research published in the last year.
The following nominations have been received for the 2026 award:
Title of research: BPFdoor in Telecom Networks: Sleeper Cells in the Backbone
Author of research: Rapid7 Labs but in particular: Edoardo Edoardo Giuggioloni, Christiaan Beek and Jindrich Karasek
Please explain why you are nominating this piece of research:
"Our BPFDoor research (blogs and paper) should be nominated because it combined deep technical research with direct, real-world impact in our humble opinion.
"Over many many (9+)months, our team worked long hours and weekends with agencies and CERTs around the world to understand, detect, and disrupt a highly stealthy threat targeting telecommunications, defence, government, and critical infrastructure. New capabilities and evasion techniques were discovered. We provided briefings, custom tools, scripts, and detection signatures to help organisations identify and block the threat. This was happening a lot in the back before we could go live and still research is going on and collaboration without making too much noise. Even industry peers chimed in and offered samples, their info to help blocking this major threat. This was not research for publication alone. A compromise in the telecommunications sector can affect far more than one victim; it can impact critical services and national security."
Link (note, link added by VB, not by person/s nominating):
https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/
Title of research: VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun
Author of research: Check Point Research
Please explain why you are nominating this piece of research:
"We're nominating this research because it's the first documented case that gives real evidence, not speculation, that a fully capable malware framework can be built almost entirely by AI. The team traced operational security failures by the malware's own developer back to the AI generated planning artifacts themselves, uncovering a Spec Driven Development process where the model was first tasked with producing a full multi team development plan, sprint schedules and all, before it ever wrote a line of code. That plan was then followed to actually build a working implant with eBPF and LKM rootkit capabilities in under a week.
"This matters for the Péter Szor award because it's not just a trend piece about AI and security. The team reconstructed the entire development timeline from leaked artifacts and cross checked it against the malware's technical capabilities, eBPF hooks, cloud enumeration modules, container escape logic, to prove the AI generated code held up to real scrutiny rather than just looking plausible. That kind of grounded, artifact driven analysis is exactly the discipline Péter brought to his own research, and it gives the industry its first hard evidence of a shift that people have been predicting for years without proof."
Link (note, link added by VB, not by person/s nominating):
https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/
Title of research: Silent Lynx: Uncovering a Cyber Espionage Campaign in Central Asia
Author of research: Sathwik Ram Prakki & Subhajeet Singha (Seqrite Labs, Quick Heal)
Please explain why you are nominating this piece of research:
"I am nominating Silent Lynx: Uncovering a Cyber Espionage Campaign in Central Asia for its exceptional technical depth, originality, and contribution to the cybersecurity community.
"The research provides a comprehensive analysis of a previously undocumented cyber espionage campaign targeting government, financial, and diplomatic organizations across Central Asia. It combines detailed malware reverse engineering with infrastructure hunting, campaign correlation, and attribution analysis, reconstructing the complete attack lifecycle from spear-phishing and multi-stage infection chains to command-and-control infrastructure and persistence mechanisms.
"What distinguishes this work is its ability to connect multiple campaigns, uncover operational overlaps with the YoroTrooper threat actor, and provide actionable intelligence for defenders. The combination of technical rigor, original threat discovery, and practical detection insights makes it a significant contribution to threat intelligence and malware research.
"This research embodies the technical excellence and impact that the Péter Szőr Award seeks to recognize."
Link (note, link added by VB, not by person/s nominating):
Title of research: Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
Author of research: Aleksandra "hasherezade" Doniec (Check Point Research)
Please explain why you are nominating this piece of research:
"We're nominating this research because it tackles a problem that most analysts would simply give up on. JSCeal doesn't just obfuscate its JavaScript, it compiles it into V8 bytecode and ships it as cached data, stripping away nearly everything that source oriented tooling depends on. Rather than treat this as a dead end, hasherezade built a fully static deobfuscation pipeline from the ground up, extending an existing open source decompiler and writing dedicated passes for value propagation, string reconstruction, control flow unflattening, and proxy resolution, all without ever executing the malware.
"What sets this apart is that the outcome isn't just a one time analysis of a single sample. It's a reusable, publicly released toolkit that lets any researcher recover readable structure from this class of compiled bytecode malware going forward. That's the kind of durable contribution to the field that the Péter Szor award was created to recognize, deep technical craft applied in service of the wider community, not just a single write up.
"The work was also rigorously validated rather than taken on faith. hasherezade tested an LLM assisted renaming stage against real datasets and documented exactly where it helped and where it fell short, which reflects the same careful, evidence driven approach Péter was known for in his own research."
Link (note, link added by VB, not by person/s nominating):
Title of research: Malware analysis assisted by AI with R2AI
Author of research: Axelle Apvrille & Daniel Nakov (Fortinet)
Please explain why you are nominating this piece of research:
"With AI, things go very fast, but this paper contains the foundations for malware analysis assisted by AI.
"Before that,
- there were NO disassembler or decompiler that integrated AI
- Basically, radare2 implemented the concept of MCP before it existed! Now, MCPs are common :)
"So, this paper is sort of "historical" paper which showed significant progress in use of AI. Now, 1.5 year after, we do better, faster, but it was a foundation block."
Link (note, link added by VB, not by person/s nominating):
https://arxiv.org/html/2504.07574
Title of research: Webworm: New burrowing techniques
Author of research: Eric Howard (ESET)
Please explain why you are nominating this piece of research:
"Webworm: New burrowing techniques, published on WeLiveSecurity on 20 May 2026, is an outstanding piece of technical security research into a China-aligned APT group.
"The research describes two previously unknown backdoors: EchoCreep, which uses Discord for C&C, and GraphWorm, which abuses the Microsoft Graph API and OneDrive. Together, they give defenders practical insight into the growing APT practice of concealing command-and-control traffic within trusted cloud services. The campaign affected at least 56 targets across several countries, including Spain, Hungary, Belgium, Nigeria, Czechia, and Serbia.
"What sets this work apart is the rare visibility it provides into the attackers' own operations. ESET decrypted more than 400 AES-CBC-encrypted Discord C&C messages and recovered a bash history file from an operator server, exposing reconnaissance against over 50 unique targets and the group's likely initial-access tradecraft, including open-source scanners (nuclei, dirsearch) and a SquirrelMail RCE exploit (CVE-2017-7692). The attribution is particularly noteworthy: although ESET had privately tracked Webworm since Symantec first disclosed the group in 2022, this is the first analysis in which they were able to publicly attribute the activity based on direct evidence. Decrypted Discord identifiers led to a GitHub staging repository created as a direct fork of the legitimate WordPress project, and then to a SoftEther configuration containing an IP address tied to known Webworm infrastructure.
"The report also reverse engineers four custom proxy tools (WormFrp, ChainWorm, SmuxProxy, WormSocket), reveals a compromised Amazon S3 bucket used for C&C configuration and data exfiltration at the victims' expense, and had real-world impact: victims were notified and the group's staging infrastructure was taken down.
"Rigorous, in-depth, and immediately valuable to defenders, this research is a strong candidate for the Péter Szőr Award."
Link (note, link added by VB, not by person/s nominating):
https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/
Title of research: BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
Author of research: Jiří Vinopal (Check Point Research)
Please explain why you are nominating this piece of research:
"We're nominating this research because it represents exactly the kind of hands on technical work that Péter Szor exemplified throughout his career. Jiří didn't just observe a vulnerability, he reverse engineered an entirely undocumented kernel driver protocol from scratch, working out its RC4 encrypted transaction format and integrity validation scheme through pure analysis, with no existing documentation to build on. He then went a step further and built BTR_CLI, a working tool that proves the primitive functions exactly as reconstructed, which is the kind of validation that separates real research from speculation.
"What makes this especially significant is that BTR.sys is a Microsoft signed component built into Windows Defender itself, so this isn't a case of finding a third party vulnerable driver to abuse. Jiří showed that a trusted piece of security infrastructure can be turned into a fully functional Ring 0 execution primitive without exploiting any vulnerability at all, and he did it before any threat actor had been observed using the technique, giving defenders a real window to prepare detection before it appears in the wild.
"The research spans kernel internals, binary protocol reverse engineering, and detection engineering, and it was strong enough to be selected for both Black Hat USA and DEF CON this year. We think it's a strong candidate for the Péter Szor Award because it embodies the depth of technical craft the award was created to honor."
Link (note, link added by VB, not by person/s nominating):