CAPEv2 Malware Sandbox
Production malware analysis environment running on AWS EC2 with KVM/QEMU nested virtualization. Windows 10 guest VM for automated behavioral analysis, memory forensics, and network capture.
OSINT Collection Framework
Automated reconnaissance pipeline combining passive DNS, certificate transparency, subdomain enumeration, and web archive analysis for attack surface mapping.
Threat Intel Aggregator
Custom threat intelligence platform that correlates IOCs across multiple feeds, enriches with context, and produces actionable alerts with MITRE ATT&CK mapping.
Network Traffic Analysis Lab
Isolated network environment for analyzing captured traffic, detecting C2 communications, and developing network-based detection signatures.
RE Workstation
Dedicated reverse engineering environment with Ghidra, x64dbg, and custom scripts for static and dynamic analysis of malware binaries.
Honeypot Network
Distributed honeypot deployment across cloud providers to collect real-world attack telemetry, credential dumps, and malware samples.