Accompanied by a delegation from the Region and ANSSI, Prefect Franck Robine visited IRISA on Thursday 9 April 2026 to learn about the centre’s outstanding research and academic strengths in cybersecurity and artificial intelligence.
This immersion at the heart of the Breton ecosystem provided an opportunity to highlight the progress and projects led by the University of Rennes and its ecosystem: IRISA, the University of Rennes’ Inria centre, IETR, and Lab-STICC, as well as key initiatives such as LabEx CominLabs, the SequoIA Cluster and the EUR CyberSchool, and CreachLabs
Within the laboratory, several research teams are conducting work in cybersecurity or closely related to this field (CAPSULE, SPICY, PIRAT, SUSHI, SOTERN, SECREIZH, ARTISHAU, etc.).
This expertise was demonstrated in particular through two presentations by its research teams: one given by Dorian Bachelot (a research engineer at CentraleSupélec and member of the PIRAT research team), and the other by Mohamed Sabt (professor at the University of Rennes and member of the SPICY research team).
Demonstration 1:
Presentation of the ShareMal platform and a honeypot campaign
To begin with, an in-depth demonstration of the ShareMal platform was given. This tool, designed for the analysis and storage of malware in the academic sector, is hosted at the Laboratoire Haute Sécurité (LHS) in Rennes. The presentation also served as an introduction to TraceMal, a new dynamic analysis tool developed in-house at the LHS, which incorporates numerous innovative features for analysing the most sophisticated malware.
A second demonstration then focused on a Honey Pot* campaign targeting a critical vulnerability (React2Shell). The analysis highlighted the Honey Pot*’s ability to dynamically feed ShareMal with a variety of malicious samples, many of which were previously unseen. This demonstration included: mapping the temporal evolution of attacks over four months (including analysis of the intensity and industrialisation of tactics), and the use of a dynamic graphical representation tool for the precise clustering of malicious actor profiles, which is due to be published shortly.
*A honeypot is a decoy deployed on a network to attract attackers and analyse their behaviour.
Find out more about Honey Pots : https://www.inria.fr/fr/hoplab-cybersecurite
Spotlight on the PIRAT research team
The PIRAT research team studies how attackers move through the entire information system chain in order to gain control of it. This research leads to the development of innovative tools that can be rapidly transferred to industry for testing, detection, training and protection. The research team possesses a sufficiently broad range of expertise to cover the entire hardware and software chain that may be involved in what are euphemistically referred to as security incidents.
What interests us are the overall attack scenarios. An information system is often heterogeneous and consists of many connected machines. The attacker does not reach the right place straight away. They gain entry somewhere during an initial compromise. They then seek to move around, progressing through the system step by step, to reach their target, take control of it and complete their attack. We are therefore seeking to understand how this attacker operates. Where they go. How we detect them. And from there, how to design resilient tools.
Valérie Viet Triem Tong, Professor at CentralSuppelec, Head of the Pirat’ research team);
Demonstration 2:
Google Wallet: when your digital wallet isn’t as secure as you might think
Digital wallets on smartphones, such as Google Wallet, are becoming the dominant method of payment. By 2025, Google Wallet will have over 200 million users worldwide, but just how secure is it really?
In this study, we have scrutinised Google Wallet’s security mechanisms. At the heart of the system lies an encryption key designed to protect your banking details even if a hacker gains full access to your phone.
Our research reveals that this protection has significant flaws. We managed to extract this secret key on several versions of Android, which allowed us to fully decrypt the details of a bank card stored in the app.
From there, we developed what we call a ‘hack-and-pay’ attack: by copying a bank card to another device, it becomes possible to make fraudulent payments without triggering a single security alert from the bank or Google.
Spotlight on the SPICY research team
The SPICY (Security & PrIvaCY) research team focuses on issues relating to cryptographic protocols, privacy, and formal methods for security.
In light of the widespread adoption of digital technologies, the team’s work aims to design and analyse more secure systems, drawing on formal methods grounded in rigorous mathematical principles. In a context where the risks of breaches and data leaks persist, these approaches enable the systematic evaluation of the security and privacy of the systems used in everyday life.
Find out more about the research team SPICY