About
Security researcher with 10+ years in the field spanning both red and blue teams. I specialize in malware analysis, reverse engineering, client-side threat detection, and WAF engineering.
I've worked in SOCs (Tier 1–3), built IPS/IDS signatures, and currently focus on web application firewall engineering and cloud-scale threat intelligence at Cloudflare. I compete with Water Paddlers in CTFs, finishing 2nd at DEF CON three consecutive years (2023–2025).
Experience
Latest Research
Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration. All analysis and c...
TLDR I am not working full time right now, which means I have free time which is dangerous. You start by reading one V8 ...
Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration. All analysis and c...
The Anti-India Influence Machine: Troll Farms, Fake News, Newsrooms, Algorithms and AI Scope and disclaimer: This is a c...
TLDR I independently found a heap out-of-bounds read/write in KVM’s SEV-SNP Page State Change handler. A malicious...
Published at Cloudflare, c/side & Symantec
ML-driven detections in practice.
Mitigations and lessons from the field.
Deep dive into the compromise chain and mitigations.
Attack surface and mitigations.
How malicious actors hijack traffic and commit affiliate fraud — and defenses that work.
Rule design and tuning.
Rapid response at scale.
Trends from global traffic.
Limits of IoCs and how to augment them.
OAuth abuse patterns on the client side.
Multi-platform targeting via UI manipulation.
Abusing web app install flows for fraud.
Mass injections and redirect monetization.
Campaign evolution and blockers.
Third-party supply chain risk realized.
Operational impact and how we adapted.
Indicators and containment.
Where inline protections fall short.
Cross-platform payload delivery.
Infrastructure re-use and takedown paths.
Obfuscation tricks and exfil flows.
Third-party trust boundaries tested.
Merchant-side script compromise analysis.
Repeat patterns, repeat impact.
Field report on active exploitation.
Localization tactics in fraud ops.
Social lures meet exploit delivery.
Conference Talks
A summary of attacks seen by Cloud Intel. [PDF]
Arsenal demo of unsupervised malware family classification. [PDF] · [GitHub]
Router exploitation and botnet infrastructure analysis.
Fileless malware techniques and detection challenges.
In The Media
WordPress Sites Hijacked to Push Malware
Short-lived Certificates — What IT Should Know
Crush Your New Gig in Cybersecurity From Day One
Security Week — Magecart Attacks
Patents & Papers
Symantec / Broadcom
ISTR threat landscape report
Projects
AI firewall for detecting & preventing prompt injection attacks.
Unsupervised clustering of malware families via ML.
High-fidelity public cloud threat intel and atomic IOCs.
LLaMA-based personal model on Cloudflare Workers.
Tracking blocked websites and apps worldwide.
Calendar built with ChatGPT & Cloudflare Workers.
Find Me Online
Get In Touch
$ For speaking engagements, research collaboration, or security consulting.