The framework starts
First lines of the ESP32 framework. Agents for IoT/OT security research.
What this is
Espilon is a French loi 1901 non-profit built around embedded, IoT and OT security. We're hardware people: we extract firmware, reverse it, find the bugs, report them, and write up how it was done. The tools we build to do that are open source, and the CTF we run exists so other people can learn the same tricks.
- Find and responsibly disclose vulnerabilities in embedded code
- Build and maintain the open-source ESP32 framework
- Run a hardware / IoT / OT CTF and publish the write-ups
- Share what we learn: talks, articles, students
How we got here
From a side project to a declared association with a CVE list.
2025 · Inception
Feb 2026 · Release
espilon-source v0.1.0
Core refactor, five new ESP32 modules, a stable modular architecture.
2026 · CTF
Espilon CTF: 28 challenges
A hardware CTF on IoT/OT and ESP32. 1,479 players showed up. Write-ups published. CTF →
14 Apr 2026 · Association
Association declared
Constituent assembly. A loi 1901 non-profit, on paper.
11 Jun 2026 · Release
Espilon Monitor v0.1.0
Universal serial monitor for embedded devices. Multi-port, pattern files for ESP32/STM32/Arduino, Python hooks, JSON stream, daemon mode.
13 Jun 2026 · Release
Espilon-Firmware v0.2.0
First public release. ESP32 loader, crypto core (ChaCha20-Poly1305 + HKDF), WiFi and GPRS transports, anti-forensic IRAM wipe.
13 Jun 2026 · Release
C3PO v0.2.0
Operator server: Qt6 desktop app, TCP C2, per-device keystore, module compiler and injector, OTA trigger.
13 Jun 2026 · Release
ESPM v0.2.0
Dynamic ELF loader for ESP32. Xtensa and RISC-V, HMAC-SHA256 signature check, 110-function syscall table, per-module watchdog.
2026 · Disclosure
13 CVEs and counting
Published advisories in Espressif, AWS/FreeRTOS, Arduino and BACnet code, with more in coordination. Advisories →
Work with us
Collaboration, an internship, a CTF, or you just want to support the work.
Association Espilon
Open to technical collaborations, academic partnerships and internships. If you want to support an independent non-profit doing this work, the door's open. Just email us.
Non-profit association, loi 1901 · Declared April 2026 · France