Multi-Stage MaaS Malware and Developer Supply-Chain Infection Analysis
At the beginning, I had no idea what void.exe was connected to. It looked like a suspicious file that had been shared with me for analysis. I moved it into a REMnux...
X-3306
Independent security research lab
I study how attackers operate and how defenders can make that more expensive. This site is the lab notebook: tools I built, experiments I ran, disclosures I filed and what I plan to try next. Some of it is finished. Some of it failed, and that is written down too.
- threat intelligence
- Malware analysis
- Security research
- Open-source tooling
Lab map
Walk in through any door. The map is the menu.
- ProjectsTen things I built, am building or only sketched, each with an honest status.
- DisclosuresBug bounty and coordinated disclosure, listed with the severity I was actually given.
- RoadmapA trail map of what is running now, what comes next and what may never happen.
- WritingReports and notes from Medium, pinned up automatically as they appear.
- TarnhavenThe AI-agent defense study that ended early with zero participants, and why that is still worth writing down.
- AboutWho runs the lab, how a project goes from question to write-up, and the year so far.
NOW
On the desk
as of October 2026Closed
Tarnhaven ended early. Nobody took part, so there is no dataset, only a write-up to do.
In progress
Write-ups of the BreachDirectory and AI-platform findings.
Next
The honeypot farm proof of concept, and mapping an Active Directory lab by hand.
NEW
Latest writing
synced from Medium
Shifting the EDR Evasion Angle: From Signature Obfuscation to Behavioral Camouflage
I’ve been working on a research project that explores a slightly different angle on EDR and AV evasion. Rather than relying on traditional signature obfuscation or...