Dancing Bears & Stolen Crypto: A Tabletop DPRK Drama

There's a Korean saying: 재주는 곰이 부리고 돈은 주인이 받는다 "the bear does the tricks, but the owner takes the money." It fits the DPRK perfectly: operators run the heists, the regime takes the crypto.

This talk turns that drama into a purple team tabletop you can run next week. The focus is methodology and mindset, not tooling. Tabletops fail when they drill the technology but never train the humans.

We fix that by building the exercise around real procedures from a DPRK campaign: the fake recruiter, the trojanized coding assessment, the staged loader-then-RAT, the wallet drain. Each procedure runs as a red-describes / blue-responds exchange: red narrates how the technique actually executes, blue calls the detection, the data source, and the gap.

You'll learn a repeatable method: select a DPRK threat profile, decompose it into MITRE ATT&CK-mapped procedures, and design branching injects that force real decisions under pressure.

The goal is to develop analyst instinct by teaching people to think in adversary procedures before they reach for a console.

You'll leave with a framework and templates to anchor your first procedure-based exercise to the DPRK behaviors that target your sector and a room that's been trained to think, not just click.

Speakers:

Cat Self, Senior Director Adversary Research, Tidal Cyber

Cat Self is the Senior Director of Adversary Research at Tidal Cyber, where she leads adversary research and content development with a focus on procedural-level intelligence. Before Tidal, she was the macOS/Linux Lead for MITRE ATT&CK®, founded the CTI team behind ATT&CK Evaluations, and helped train allied partner nations.

Her path spans from Army Airborne military intelligence veteran to offensive engineering at Target, where she earned a patent and became their first female red team operator and first full-time threat hunter. She shares knowledge often through coded emulations, walkthroughs, research-driven presentations, and mentorship, and believes all work should be like the tide, raising all ships.

Off the clock, you can find her climbing a mountain abroad, learning Chinese through Chinese dramas, or salsa dancing.