Aryan Singh

OP-001 · Adversary Emulation Program APT29 Complete · 7/7 EDRs

APT Emulation Program

A research program reconstructing nation-state TTPs into functional offensive tooling — built from primary-source threat intelligence by Mandiant, MSTIC, CrowdStrike, LAB52, and FireEye. Each emulation takes a named campaign, reverse-engineers the actual behavioral patterns documented in the report, then re-implements them as working tools engineered to evade current enterprise defenses.

APT29 / Cozy Bear is the first completed emulation. A fully custom C2 framework and implant written from scratch in C, Python, and x86-64 assembly — no Cobalt Strike, no Brute Ratel, no Sliver. The implant architecture is inspired by LAB52's analysis of EasterBunny, APT29's Stage 3 implant from a 2019 SVR operation: matryoshka-style encrypted payload nesting, PEB-walk API resolution via gs:[0x60], machine-bound decryption keys, and a reflective PIC loader. Tested and validated against 7 enterprise EDR products with stable beacons and command execution confirmed on each.

APT Roster

APT29 Cozy Bear / NOBELIUM ● Complete — 7/7 EDRs

APT28 Fancy Bear / SOFACY ● Next

Turla Venomous Bear ○ Queued

Sandworm Voodoo Bear ○ Queued

Berserk Bear Dragonfly / Energetic Bear ○ Queued

EDR Bypass Results — APT29 Implant

CrowdStrike Falcon ● Bypassed

SentinelOne ● Bypassed

Cortex XDR ● Bypassed

Microsoft Defender ● Bypassed

Bitdefender ● Bypassed

Sophos ● Bypassed

Elastic Security ● Bypassed

01Init Access

02C2 Setup

03Discovery

04UAC Bypass

05Priv Esc

06Cred Access

07Def Evasion

08Persistence

09Lat Move

10Dom Priv Esc

11Dom Persist

12Cleanup

C2 Framework → HTTPS Domain-Fronted HAMMERTOSS POSHSPY WMI Custom teamserver · 3 independent C2 channels · Burn one, two survive

C / Win32x86-64 ASMIndirect SyscallsEkko Sleep Mask Stack SpoofingModule StompingSection MappingRDLL Domain FrontingHAMMERTOSSWMI Backdoor PEB WalkPythonThreat Intel

EDRs Bypassed7/7

C2 Channels03

APTs Queued05

Case file → Source →

OP-002 · Browser-resident defense Shipping · 75+ installs

ClickArmor

A browser extension built to catch what traditional endpoint tools miss — ClickFix lures, clipboard hijacking chains, credential phishing, and social engineering pretexts at the moment of contact.

Analyzed 55,000+ phishing samples from PhishTank and ThreatFox to extract indicators and validate detection coverage against live adversary infrastructure.
Reverse-engineered 5,000+ ClickFix domains to map execution chains, staging infrastructure, and obfuscation patterns.
Enterprise offering (Armor Console) includes Splunk SIEM integration with structured ditm:armor:agent events and agent enrollment.

ExtensionClickFixClipboard HijackSplunk SIEMArmor Console

Installs75+

TelemetrySplunk

Samples55k+

Request demo →

OP-003 · Offensive Infra Lab Operational

Phishing Infrastructure Lab

End-to-end AiTM phishing range built to study adversary delivery infrastructure, MFA bypass techniques, and anti-analysis evasion.

Deployed Evilginx with custom phishlets for MFA bypass and session hijacking; automated provisioning with Terraform and Caddy reverse proxies.
Implemented JA4 fingerprinting, headless browser detection, website keying, and dynamic obfuscation to study anti-analysis evasion patterns.
Tested HTML smuggling via SVG payloads against Google Safe Browsing to understand delivery evasion at scale.

AiTMEvilginxMFA BypassJA4HTML SmugglingTerraform

Lab notes →

DF-001 · Cloud-Native EDR Built

Shelter EDR — Cloud-Native Endpoint Telemetry Platform

A self-built EDR exploring what it takes to collect, process, and visualize endpoint telemetry at scale — designed to understand the defender's side of the stack from first principles.

Built a Go-based agent with a distributed ingestion API for real-time endpoint telemetry collection.
Designed a Redis-backed async pipeline processing 3,000+ events/sec at sub-120ms latency.
Deployed Dockerized services with cloud-hosted PostgreSQL and Redis for scalable, fault-tolerant event processing.
Implemented batching, compression, and retry logic maintaining under 3% CPU and 50MB memory per endpoint.
Built a React dashboard for host monitoring, event visualization, and alert triage.

GoPostgreSQLRedisReactDockerAWS

Throughput3k+/s

Latency<120ms

Mem/host<50MB

DF-002 · Malware Analysis Lab Ongoing

Malware Analysis & RE Lab

A home lab for static and dynamic malware analysis — built to understand how malware behaves before writing detections for it.

Built an isolated sandbox environment; used PEStudio and CAPA to study malware families including ransomware and malicious documents.
Performed static analysis on malware binaries with Remnux and Ghidra — studying import tables, process trees, and function call patterns.
Analyzed dynamic malware behavior using SysInternals to observe running processes, file system changes, and registry modifications.

GhidraPEStudioCAPARemnuxSysInternals

DF-004 · Mobile Security Lab

Android Pentesting Lab

Hands-on exploration of Android application security vulnerabilities and mobile penetration testing techniques.

Deployed InjuredAndroid on an API Level 29 Android virtual machine to study and exploit common mobile vulnerabilities.
Used Jadx and Android Studio to discover security misconfigurations exposing sensitive Firebase and AWS database credentials.
Injected Frida manually and used Objection to disable SSL pinning for traffic interception and analysis.

AndroidFridaObjectionJadxSSL Pinning

NW-001 · Enterprise Network Lab Built

Enterprise Network Engineering Lab

A from-scratch enterprise network simulation covering routing, switching, segmentation, and security policy.

Implemented dual-router OSPF with inter-VLAN routing, DHCP, and NAT across a multi-segment topology.
Deployed VLAN-aware ACLs for HTTP/HTTPS/FTP traffic segmentation policies and destination NAT to publish IIS services.
Configured MSTP for loop-free Layer-2 redundancy and fault tolerance across the switching fabric.

OSPFVLANsACLsNATMSTP

NW-002 · AD & Virtualization Lab Built

AD & vSphere Infrastructure Lab

A multi-site Active Directory and virtualized infrastructure lab built to understand enterprise identity and compute environments — the same environments that get compromised.

Constructed a multi-site Active Directory domain with 4 domain controllers and 6 clients with DNS-integrated authentication and name resolution.
Deployed enterprise services on VMware ESXi/vSphere with centralized management via vCenter.

Windows ServerActive DirectoryDNSVMware ESXivSphere

NW-003 · Cloud IoT Lab Built

Cloud IoT Device Emulation Lab

Emulated outbound-only cloud-connected IoT device behavior to study connectivity failure modes and support escalation patterns.

Reproduced offline states via DNS/NTP blocks, firewall and NAT changes, and MTU mismatch scenarios.
Root-caused failures using packet captures and connection traces; produced symptom-to-fix documentation for support-style escalation.
Built a companion pre-deployment network validation tool evaluating DNS resolution, TLS connectivity, NTP sync, MTU limits, and proxy behavior.

PythonTCP/IPTLSDNSNTPLinux

Experience.

Projects.