Aryan Singh

OP-001 · Adversary Emulation Program In Progress · APT29 Phase 1

APT Emulation Program

A research project reconstructing nation-state TTPs into functional tooling — built from primary-source threat intelligence reports, not ATT&CK generics. Each emulation takes a named campaign, extracts the actual behavioral patterns documented by Mandiant, MSTIC, CrowdStrike, and FireEye, then re-implements them as working tools engineered to evade 2026 enterprise defenses.

APT29/NOBELIUM is the first active emulation. Custom tooling written in C, Python, and PowerShell — EnvyScout HTML smuggler, evasive loader (Hell's Gate indirect syscalls, Ekko sleep masking, call stack spoofing), and a POSHSPY WMI backdoor. Tested against Elastic EDR 9.3 in full block/prevent mode and Windows Defender.

APT Roster

APT29 Cozy Bear / NOBELIUM ● In Progress

APT28 Fancy Bear / SOFACY ○ Queued

Turla Venomous Bear ○ Queued

Sandworm Voodoo Bear ○ Queued

Berserk Bear Dragonfly / Energetic Bear ○ Queued

01Init Access

02C2 Setup

03Discovery

04UAC Bypass

05Priv Esc

06Cred Access

07Def Evasion

08Persistence

09Lat Move

10Dom Priv Esc

11Dom Persist

12Cleanup

Also building → CLASSIFIED C2 framework with runtime TTP switching — behavioral profiles for each Bear. Hover to un-redact.

C / Win32Indirect SyscallsEkko Sleep Mask Stack SpoofingHTML SmugglingWMI Backdoor PythonPowerShellThreat Intel

EDR Detections00

APTs Queued06

Tools Authored07+

Case file → Source →

OP-002 · Browser-resident defense Shipping · 75+ installs

ClickArmor

A browser extension built to catch what traditional endpoint tools miss — ClickFix lures, clipboard hijacking chains, credential phishing, and social engineering pretexts at the moment of contact.

Analyzed 55,000+ phishing samples from PhishTank and ThreatFox to extract indicators and validate detection coverage against live adversary infrastructure.
Reverse-engineered 5,000+ ClickFix domains to map execution chains, staging infrastructure, and obfuscation patterns.
Enterprise offering (Armor Console) includes Splunk SIEM integration with structured ditm:armor:agent events and agent enrollment.

ExtensionClickFixClipboard HijackSplunk SIEMArmor Console

Installs75+

TelemetrySplunk

Samples55k+

Request demo →

OP-003 · Offensive Infra Lab Operational

Phishing Infrastructure Lab

End-to-end AiTM phishing range built to study adversary delivery infrastructure, MFA bypass techniques, and anti-analysis evasion.

Deployed Evilginx with custom phishlets for MFA bypass and session hijacking; automated provisioning with Terraform and Caddy reverse proxies.
Implemented JA4 fingerprinting, headless browser detection, website keying, and dynamic obfuscation to study anti-analysis evasion patterns.
Tested HTML smuggling via SVG payloads against Google Safe Browsing to understand delivery evasion at scale.

AiTMEvilginxMFA BypassJA4HTML SmugglingTerraform

Lab notes →

DF-001 · Cloud-Native EDR Built

Shelter EDR — Cloud-Native Endpoint Telemetry Platform

A self-built EDR exploring what it takes to collect, process, and visualize endpoint telemetry at scale — designed to understand the defender's side of the stack from first principles.

Built a Go-based agent with a distributed ingestion API for real-time endpoint telemetry collection.
Designed a Redis-backed async pipeline processing 3,000+ events/sec at sub-120ms latency.
Deployed Dockerized services with cloud-hosted PostgreSQL and Redis for scalable, fault-tolerant event processing.
Implemented batching, compression, and retry logic maintaining under 3% CPU and 50MB memory per endpoint.
Built a React dashboard for host monitoring, event visualization, and alert triage.

GoPostgreSQLRedisReactDockerAWS

Throughput3k+/s

Latency<120ms

Mem/host<50MB

DF-002 · Malware Analysis Lab Ongoing

Malware Analysis & RE Lab

A home lab for static and dynamic malware analysis — built to understand how malware behaves before writing detections for it.

Built an isolated sandbox environment; used PEStudio and CAPA to study malware families including ransomware and malicious documents.
Performed static analysis on malware binaries with Remnux and Ghidra — studying import tables, process trees, and function call patterns.
Analyzed dynamic malware behavior using SysInternals to observe running processes, file system changes, and registry modifications.

GhidraPEStudioCAPARemnuxSysInternals

DF-004 · Mobile Security Lab

Android Pentesting Lab

Hands-on exploration of Android application security vulnerabilities and mobile penetration testing techniques.

Deployed InjuredAndroid on an API Level 29 Android virtual machine to study and exploit common mobile vulnerabilities.
Used Jadx and Android Studio to discover security misconfigurations exposing sensitive Firebase and AWS database credentials.
Injected Frida manually and used Objection to disable SSL pinning for traffic interception and analysis.

AndroidFridaObjectionJadxSSL Pinning

NW-001 · Enterprise Network Lab Built

Enterprise Network Engineering Lab

A from-scratch enterprise network simulation covering routing, switching, segmentation, and security policy.

Implemented dual-router OSPF with inter-VLAN routing, DHCP, and NAT across a multi-segment topology.
Deployed VLAN-aware ACLs for HTTP/HTTPS/FTP traffic segmentation policies and destination NAT to publish IIS services.
Configured MSTP for loop-free Layer-2 redundancy and fault tolerance across the switching fabric.

OSPFVLANsACLsNATMSTP

NW-002 · AD & Virtualization Lab Built

AD & vSphere Infrastructure Lab

A multi-site Active Directory and virtualized infrastructure lab built to understand enterprise identity and compute environments — the same environments that get compromised.

Constructed a multi-site Active Directory domain with 4 domain controllers and 6 clients with DNS-integrated authentication and name resolution.
Deployed enterprise services on VMware ESXi/vSphere with centralized management via vCenter.

Windows ServerActive DirectoryDNSVMware ESXivSphere

NW-003 · Cloud IoT Lab Built

Cloud IoT Device Emulation Lab

Emulated outbound-only cloud-connected IoT device behavior to study connectivity failure modes and support escalation patterns.

Reproduced offline states via DNS/NTP blocks, firewall and NAT changes, and MTU mismatch scenarios.
Root-caused failures using packet captures and connection traces; produced symptom-to-fix documentation for support-style escalation.
Built a companion pre-deployment network validation tool evaluating DNS resolution, TLS connectivity, NTP sync, MTU limits, and proxy behavior.

PythonTCP/IPTLSDNSNTPLinux

Experience.

Projects.