Investigation Portfolio

Threat Investigations

Structured cyber threat investigations worked end to end in realistic training environments. Each report documents analytical methodology, evidence collection, pivoting, and findings. Investigations are grouped by the platform they originated from. That source determines the kind of evidence available and the tradecraft the investigation demonstrates. These are scenario-based investigations, not real-world client engagements.

View KC7 Profile → View Darkroom Profile →

KC7 Cyber Detection, KQL, threat hunting, incident reconstruction, and ATT&CK-mapped intrusion analysis.
Flare Darkroom Dark-web intelligence, initial access brokers, credential ecosystems, ransomware operations, and cross-forum correlation.

Flare Darkroom Investigation

Inside Flare Darkroom: From Initial Access to Credential Exposure

Following a simulated Initial Access Broker investigation in Flare Darkroom and tracing NovaCrest credential exposure back to a third-party compromise.

Cyber Threat Intelligence · Dark Web Intelligence · Initial Access Brokers

9 min read

Part 1 of 3 Read investigation →

Flare Darkroom Investigation

Inside Flare Darkroom: Following the Ransomware and Credential Economy

Following the NovaCrest investigation through ransomware operations, credential stuffing, account resale, and the underground credential economy.

Ransomware · Ransomware-as-a-Service · Threat Actor Analysis

8 min read

Part 2 of 3 Read investigation →

Flare Darkroom Investigation

Inside Flare Darkroom: Cross-Forum Intelligence and Simulated Threat-Actor Engagement

Correlating an Initial Access Broker across underground forums and examining analyst tradecraft through Flare Darkroom's simulated threat-actor negotiation.

Threat Intelligence · Cross-Forum Intelligence · Threat Actor Analysis

14 min read

Part 3 of 3 Read investigation →

KC7 Cyber Investigation

Inside Encryptodera: An Insider Threat Scenario

A dual-track insider-threat investigation at Encryptodera Financial: a contractor's 27-day FTP exfiltration of cold-storage crypto-wallet secrets running in parallel with a hijacked-identity intrusion that escalates to a domain-wide Active Directory...

Insider Threat · Active Directory Ransomware

ATT&CK · 8 9 min read

Read investigation →

KC7 Cyber Investigation

Solvi Systems: A tale of Supply Chains and ICS

Triaging a complex supply-chain intrusion targeting regional energy distribution. Tracks the complete lifecycle from perimeter XSS probing and weaponized phishing documents to lateral movement and source-code exfiltration using raw web...

Critical Infrastructure · Supply Chain

ATT&CK · 8 11 min read

Read investigation →

KC7 Cyber Investigation

Valdoria Votes: Advanced Persistent Threat Analysis

Part 1 of a two-part, scenario-based investigation into a multi-stage social-engineering campaign against The Valdorian Times. Reconstructs weaponized recruitment lures, scheduled-task persistence, automated plink.exe reverse-SSH tunneling, 7-Zip data archival and...

APT Campaign · Infrastructure Tracking

ATT&CK · 7 8 min read Part 1 Published

Read Part 1 →