Aryan Singh

Projects.

AT-0007 / SECTION 02 · PROJECT ARCHIVE Organized by discipline — offensive research, defensive tooling, and infrastructure.

Offensive Research

OP-001 · Adversary Emulation Program APT29 Complete · 7/7 EDRs

APT Emulation Program

A research program reconstructing nation-state TTPs into functional offensive tooling — built from primary-source threat intelligence by Mandiant, MSTIC, CrowdStrike, LAB52, and FireEye. Each emulation takes a named campaign, reverse-engineers the actual behavioral patterns documented in the report, then re-implements them as working tools engineered to evade current enterprise defenses.

APT29 / Cozy Bear is the first completed emulation. A fully custom C2 framework and implant written from scratch in C, Python, and x86-64 assembly — no Cobalt Strike, no Brute Ratel, no Sliver. The implant architecture is inspired by LAB52's analysis of EasterBunny, APT29's Stage 3 implant from a 2019 SVR operation: matryoshka-style encrypted payload nesting, PEB-walk API resolution via gs:[0x60], machine-bound decryption keys, and a reflective PIC loader. Tested and validated against 7 enterprise EDR products with stable beacons and command execution confirmed on each.

APT Roster

APT29 Cozy Bear / NOBELIUM ● Complete — 7/7 EDRs

APT28 Fancy Bear / SOFACY ● Next

Turla Venomous Bear ○ Queued

Sandworm Voodoo Bear ○ Queued

Berserk Bear Dragonfly / Energetic Bear ○ Queued

EDR Bypass Results — APT29 Implant

CrowdStrike Falcon ● Bypassed

SentinelOne ● Bypassed

Cortex XDR ● Bypassed

Microsoft Defender ● Bypassed

Bitdefender ● Bypassed

Sophos ● Bypassed

Elastic Security ● Bypassed

01Init Access

02C2 Setup

03Discovery

04UAC Bypass

05Priv Esc

06Cred Access

07Def Evasion

08Persistence

09Lat Move

10Dom Priv Esc

11Dom Persist

12Cleanup

C2 Framework → HTTPS Domain-Fronted HAMMERTOSS POSHSPY WMI Custom teamserver · 3 independent C2 channels · Burn one, two survive

C / Win32x86-64 ASMIndirect SyscallsEkko Sleep Mask Stack SpoofingModule StompingSection MappingRDLL Domain FrontingHAMMERTOSSWMI Backdoor PEB WalkPythonThreat Intel

EDRs Bypassed7/7

C2 Channels03

APTs Queued05

Case file → Source →

OP-002 · Browser-Resident Detection Active · 75+ installs

DiTM Security

A browser-resident detection agent built to catch what endpoint tools miss — ClickFix lures, clipboard hijacking chains, credential phishing, and social-engineering pretexts at the moment of user contact.

Analyzed 55,000+ phishing samples from PhishTank and ThreatFox to extract indicators and validate detection coverage against live adversary infrastructure.
Reverse-engineered 5,000+ ClickFix domains to map execution chains, staging infrastructure, and obfuscation patterns.
Built a centralized console for agent telemetry, alert triage, and Splunk-compatible structured event forwarding.

Browser ExtensionClickFixClipboard HijackCredential PhishingSplunk

Installs75+

Samples55k+

Domains5k+

OP-003 · LLM-Driven Emulation Building

APTAgent

An open-source LLM orchestration layer for C2 frameworks that constrains autonomous operator actions to a specific APT group's known TTPs — selecting from a predefined command and tooling set per engagement.

Threat profiles defined in structured JSON mapping behavioral parameters, tool selections, and lateral movement patterns to primary-source CTI citations (MITRE ATT&CK, vendor reports, government advisories).
Agent architecture enforces strict guardrails preventing drift outside the threat model — the LLM cannot deviate from the APT's documented tradecraft, enabling reproducible, auditable adversary emulation.
Targeting initial release with APT29 and Lazarus Group profiles; designed for drop-in integration with Cobalt Strike, Sliver, and custom C2 frameworks via standardized command interface.

PythonLangChainFastAPIJSON/YAMLMITRE ATT&CKC2 Integration

OP-004 · Offensive Infra Lab Operational

Phishing Infrastructure Lab

End-to-end AiTM phishing range built to study adversary delivery infrastructure, MFA bypass techniques, and anti-analysis evasion.

Deployed Evilginx with custom phishlets for MFA bypass and session hijacking; automated provisioning with Terraform and Caddy reverse proxies.
Implemented JA4 fingerprinting, headless browser detection, website keying, and dynamic obfuscation to study anti-analysis evasion patterns.
Tested HTML smuggling via SVG payloads against Google Safe Browsing to understand delivery evasion at scale.

AiTMEvilginxMFA BypassJA4HTML SmugglingTerraform

Lab notes →

Defensive Research

DF-001 · Cloud-Native EDR Built

Shelter EDR — Cloud-Native Endpoint Telemetry Platform

A self-built EDR exploring what it takes to collect, process, and visualize endpoint telemetry at scale — designed to understand the defender's side of the stack from first principles.

Built a Go-based agent with a distributed ingestion API for real-time endpoint telemetry collection.
Designed a Redis-backed async pipeline processing 3,000+ events/sec at sub-120ms latency.
Deployed Dockerized services with cloud-hosted PostgreSQL and Redis for scalable, fault-tolerant event processing.
Implemented batching, compression, and retry logic maintaining under 3% CPU and 50MB memory per endpoint.
Built a React dashboard for host monitoring, event visualization, and alert triage.

GoPostgreSQLRedisReactDockerAWS

Throughput3k+/s

Latency<120ms

Mem/host<50MB

DF-002 · Malware Analysis Lab Ongoing

Malware Analysis & RE Lab

A home lab for static and dynamic malware analysis — built to understand how malware behaves before writing detections for it.

Built an isolated sandbox environment; used PEStudio and CAPA to study malware families including ransomware and malicious documents.
Performed static analysis on malware binaries with Remnux and Ghidra — studying import tables, process trees, and function call patterns.
Analyzed dynamic malware behavior using SysInternals to observe running processes, file system changes, and registry modifications.

GhidraPEStudioCAPARemnuxSysInternals

DF-004 · Mobile Security Lab

Android Pentesting Lab

Hands-on exploration of Android application security vulnerabilities and mobile penetration testing techniques.

Deployed InjuredAndroid on an API Level 29 Android virtual machine to study and exploit common mobile vulnerabilities.
Used Jadx and Android Studio to discover security misconfigurations exposing sensitive Firebase and AWS database credentials.
Injected Frida manually and used Objection to disable SSL pinning for traffic interception and analysis.

AndroidFridaObjectionJadxSSL Pinning

Infrastructure & Networking

NW-001 · Enterprise Network Lab Built

Enterprise Network Engineering Lab

A from-scratch enterprise network simulation covering routing, switching, segmentation, and security policy.

Implemented dual-router OSPF with inter-VLAN routing, DHCP, and NAT across a multi-segment topology.
Deployed VLAN-aware ACLs for HTTP/HTTPS/FTP traffic segmentation policies and destination NAT to publish IIS services.
Configured MSTP for loop-free Layer-2 redundancy and fault tolerance across the switching fabric.

OSPFVLANsACLsNATMSTP

NW-002 · AD & Virtualization Lab Built

AD & vSphere Infrastructure Lab

A multi-site Active Directory and virtualized infrastructure lab built to understand enterprise identity and compute environments — the same environments that get compromised.

Constructed a multi-site Active Directory domain with 4 domain controllers and 6 clients with DNS-integrated authentication and name resolution.
Deployed enterprise services on VMware ESXi/vSphere with centralized management via vCenter.

Windows ServerActive DirectoryDNSVMware ESXivSphere

NW-003 · Cloud IoT Lab Built

Cloud IoT Device Emulation Lab

Emulated outbound-only cloud-connected IoT device behavior to study connectivity failure modes and support escalation patterns.

Reproduced offline states via DNS/NTP blocks, firewall and NAT changes, and MTU mismatch scenarios.
Root-caused failures using packet captures and connection traces; produced symptom-to-fix documentation for support-style escalation.
Built a companion pre-deployment network validation tool evaluating DNS resolution, TLS connectivity, NTP sync, MTU limits, and proxy behavior.

PythonTCP/IPTLSDNSNTPLinux

Experience.