Global Cybersecurity Camp (GCC) 2026- Vietnam

Overview

The Global Cybersecurity Camp (GCC) is a week-long annual international cybersecurity training program, with hosting responsibilities rotating among participating countries. Our mission is to strengthen the global security community and cultivate future cybersecurity leaders. Each year, the top 50 students from member countries gather in a host nation to exchange experiences, build lifelong friendships, and learn from leading cybersecurity professionals. Organized by non-commercial education programs and communities, the camp is supported by industry leaders committed to fostering a safer digital world.

This year, I am honored to have been selected as one of four representatives from Malaysia to participate in the GCC. I would like to express my sincere gratitude to SherpaSec, CyberWise, Stratos Security & SecIron for sponsoring my participation in this event.

Location

Hotel: Equatorial Hotel, 242 Tran Binh Trong St., Cho Quan Ward, Ho Chi Minh City, 72722, Vietnam.

Training venue: University of Science, Vietnam National University Ho Chi Minh City, 227 Nguyen Van Cu St., Cho Quan Ward, Ho Chi Minh City, 72722, Vietnam.

Industrial Session venue: Verichains Office, Z06 13 St., Tan Thuan Ward, Ho Chi Minh City, 72917, Vietnam.

Schedule

Day 0

On the first day after arriving in Vietnam, we attended the welcoming party at 6:00 PM. During this session, each participating country introduced their delegation and members, giving everyone the opportunity to get to know one another.

After the introductions, we enjoyed a wonderful dinner together and participated in a mini game designed to encourage interaction among participants. The challenge was to collect signatures from 10 different people on the spot. Fortunately, I managed to complete the task first and won the game, receiving a prize of 100,000 VND.

Day 1

The day began with the opening ceremony, followed by an ethics training session. During this session, we were introduced to two group assignments for the program. The first assignment required us to analyze five provided APK files, identify potential vulnerabilities, and develop proof-of-concept (PoC) exploits. The second assignment involved developing an Android application capable of running as a background service to monitor newly installed applications and analyze them for malicious or suspicious behavior.

The ethics session also emphasized the importance of responsible and ethical conduct in cybersecurity. Participants were reminded to uphold the principles of ethical hacking and to use their skills for defensive and constructive purposes.

In the afternoon, we attended a training session titled Introduction to IoT/ICS Security & Firmware Analysis Skills, delivered by Mars Cheng from Taiwan. During this session, we learned the fundamentals of firmware analysis, including techniques for extracting, analyzing, and conducting deeper investigations into firmware components.

After the training sessions concluded, we had dinner at a restaurant called Chai Village. I went there together with my groupmates as well as the Malaysian team, where we enjoyed a great meal and had the opportunity to further strengthen our connections.

Day 2

In the morning, we attended the session “Practical Binary Hardening with Control-flow Enforcement Technology (CET)” conducted by Kento Oki and Michael. The session introduced Control-flow Enforcement Technology (CET), a security feature proposed by Intel to help mitigate control-flow hijacking attacks caused by memory corruption. Through hands-on exercises, we explored how CET works and how to identify whether binaries support CET protections.

In the afternoon, we joined “Hypervisors for Hackers: Security from the Hardware Up” by Satoshi Tanda. This session introduced the fundamentals of hypervisors and hardware-assisted virtualization using Intel VT-x and the Rust programming language. It was an insightful session that demonstrated how hypervisors can be used to strengthen system security and defend against kernel-level attacks.

After the training sessions ended, we had dinner at Bánh Canh Cua 14, a crab noodle restaurant with delicious food. Later, we visited Asagi (Hẻm 409 Nguyễn Trãi, District 5) to shop for some wallets and belts before heading back for the groupwork.

Day 3

Day 3 featured a full-day training session titled “Super Hat’s Kernel Trick: Social Engineering the AV/EDR Kernel Protection.” The session focused on understanding how modern endpoint defenses operate at the kernel level and how attackers may bypass these protections by abusing trusted mechanisms within the Windows architecture.

This was one of the most interesting sessions of the program. The training included many hands-on exercises where we analyzed Windows internals using tools such as WinDbg. Through these practical labs, we explored how certain design assumptions in AV/EDR protections can be abused from userland without relying on traditional kernel exploits.

Overall, the session provided valuable insights into kernel-level security in Microsoft Windows, and we learned a great deal about how AV/EDR protections work and how they can potentially be bypassed in real-world scenarios.

Day 4

The morning session featured “Born in the Cloud, Breached on the On-Prem: Entra ID Attack Chains.” The training introduced the fundamentals of Microsoft Entra ID (formerly Azure Active Directory) and how identity-based attack paths can arise in modern cloud environments. The session was particularly beginner-friendly as the instructor explained the concepts from the fundamentals before moving into more advanced attack scenarios.

The training was delivered in a CTF-style format, allowing participants to apply the concepts through hands-on exercises. Through these labs, we explored how attackers may abuse authentication tokens and trust relationships to move laterally and escalate privileges within Entra ID environments, using tools such as Mimikatz and the Azure CLI.

After the morning session, we took a bus to the office of Verichains for the afternoon activities. There, we attended a Hands-on Cybersecurity AI Workshop conducted by Kar Wei Loh. The workshop was initially planned to focus on building an agentic AI penetration tester using n8n, but the session was later adapted to demonstrate how to build and configure an AI-powered penetration testing workflow using OpenCode. The workshop showed how agentic AI can assist in automating certain penetration testing tasks and improving workflow efficiency.

After the workshop, we were given the opportunity to have an industrial visit around the Verichains office. We also had dinner there while listening to several sponsors share more about their organizations and the work they are doing in the cybersecurity industry. It was a great opportunity to learn more about the industry and connect with professionals in the field.

After the event concluded, Ryan from SherpaSec and I went out for supper and had Phở, a traditional Vietnamese noodle soup. It was my first time having pho in Vietnam, and it tasted really authentic and delicious. It was a great way to end the day after a long and productive schedule.

Day 5

Day 5 marked the final day of the GCC program. In the morning, we had the Group Work Presentations followed by the Closing Ceremony, where each team presented the outcomes of their assignments. Although our group did not win the competition, I truly enjoyed the experience of collaborating with my groupmates and working together on the challenges throughout the program.

After the ceremony, we went on a city tour around Ho Chi Minh City. We visited several famous landmarks including the Saigon Central Post Office, Ben Thanh Market, and Saigon Riverside Park near the foot of Ba Son Bridge. It was a great opportunity to explore the city and experience the local atmosphere.

In the evening, we had the official after party where everyone gathered to celebrate the end of the program and enjoy some great food together. Later that night, a few of us continued the conversations with the Singapore team for a second round of discussions. After that, we headed for a third round at Haidilao Hot Pot. We took a Grab bike to get there, which was my first time riding one in Vietnam. It was a fun and memorable experience to end the trip.

Final Thought

Participating in the GCC has been one of the most memorable experiences of my life. It gave me the opportunity to connect with many talented participants from different countries, exchange ideas, and build meaningful friendships within the cybersecurity community.

Throughout the program, I learned a great deal from the training sessions, group activities, and discussions with other participants. The experience has motivated me to continue improving my skills and growing further in the cybersecurity field.

I would like to sincerely thank all the organizers, committees, and staff in Vietnam for their hard work in making GCC a successful and well-organized event. Special thanks as well to my roommate for sharing valuable knowledge about web hacking during the program.

Lastly, I would like to express my gratitude to SherpaSec, CyberWise, Stratos Security & SecIron for sponsoring me and giving me the opportunity to attend this amazing event. I truly hope to see everyone again in the future.