Case studies
Work with a public trail.
Client engagements stay confidential. These four pieces can be checked: each is written up as context, my role, the approach and the outcome, with links to read more.
Case notes
Research, analysis and exercises.
4 of 4 case notes
- Malware analysis2022 to 2023Analysing the “Nepali Girl” Android trojanAn Android app spread across Nepal as APK links in messaging apps. Victims who installed it lost control of their phones, and the campaign was linked to money taken from bank accounts.Outcome: The analysis was published by CryptoGen Nepal and covered by TechPana and Techmandu. Police later arrested eight people linked to the campaign.Read the case note
- Vulnerability research2017 to 2021CVE-2021-3258: stored XSS in a Question2Answer pluginQuestion2Answer (Q2A) is an open-source platform for question-and-answer communities. Sites extend it with plugins such as Q2A Ultimate SEO.Outcome: Recorded as CVE-2021-3258 (published 5 February 2021), CWE-79, CVSS 3.1 base score 5.4 (medium) in the NIST National Vulnerability Database.Read the case note
- Security research2018GHDB-ID 4997: finding exposed application secretsMisconfigured deployments sometimes publish their environment files, exposing application keys and debug settings to anyone with a search engine.Outcome: Published as GHDB-ID 4997 on 24 October 2018 in the “Files Containing Juicy Info” category.Read the case note
- Training and exercise2025National Cyber Drill, March 2025A four-day national exercise for engineers, officers and directors from about 30 government agencies, held 20 to 23 March 2025 (2082 BS).Outcome: The drill was completed and reported in the national press.Read the case note
Want this kind of work on your systems?
Tell me what you need to protect and by when. I'll reply with whether I can help and how I'd approach it.