Research #
22 Dec 2025
- A concolic execution engine for Solana programs
- A structure-aware coverage-guided fuzzer for Solana programs operating at the sBPF bytecode level
- A white paper about an unique multiplatform malware
- A supply-chain attack used in a cyberespionage operation targeting online‑gaming communities in Asia
17 Dec 2020
- A supply-chain attack on the website of a government in Southeast Asia.
20 Jan 2020
- Rekoobe is a minimalistic trojan with a complex CNC authentication protocol originally targeting SPARC and Intel x86, x86-64 systems back in 2015, reemerging in early 2020.
13 Dec 2019
- Analysis of new samples of ChinaZ, a Chinese-speaking cybercrime group authors of Elknot, and BillGates among other botnets.
18 Nov 2019
- Analysis of a Linux trojan in which authors tried to port to Windows.
- Analysis of a new version of Linux.WatchBog writen in Cython that was suspected to have compromised more than 4,500 linux machines, highlighting how effective Cython could be for obfuscation purposes.
- How to temporarily DoS’d the operation of a ransomware targeting Linux-based file storage systems (NAS servers) abusing on a bug in the logic of the malware.
- Analysis of a Linux implant with ties to Winnti malware used by Chinese state-nexus actors.
- Pacha Group, a Chinese-speaking group targeting cloud-based infrastructure was disrupting foothold of other crypto-mining groups, namely Rocke Group/Iron Group which was also known to target cloud environments at the time.
28 Feb 2019
- Pacha Group, a suspected Chinese-speaking ecrime group showcased unconventional Linux malware at the time, with no ties to other known threat actors.
- This was my first public malware analysis report, nothing too special really. Staying here for historic purposes
2018
Presentations #
Exploring Solana’s runtime model, sBPF ISA, and demonstrating new radare2 plug-ins developed for sBPF disassembly and analysis.
An implant designed to operate and spread through air-gapped networks.
Sep 2019
A presentation covering the intricacies of the ELF file format, and how could it be abused by threat-actors to make their malware more challenging to analyze for malware researchers.
Talk intended to document the internals of the Linux heap layout formed by the glibc malloc dynamic memory allocator algorithm along with its analysis using radare2.