~/portfolio $ whoami

Saharsh Agrawal

Security Researcher · Threat Intelligence · Pentester

I hunt for vulnerabilities, dissect malware campaigns, and turn what I learn into tooling other people can use. With a published CVE and a shelf of CTF writeups, I document every finding in full detail so it can be reproduced, reviewed, and defended against.

Projects CVE Research CTF Writeups Threat Research
17 CTF Writeups
11 Published CVEs
5 Projects & Tools
4 Threat Research Articles

$ cat ./what-i-do.md

Vulnerability Research

Source review and dynamic testing of web applications to find real, reportable bugs — open redirects, broken access control and injection flaws — then writing them up as CVEs.

Penetration Testing

End-to-end offensive engagements: enumeration, exploitation, privilege escalation and lateral movement, with every step captured so the fix is obvious at the end.

Threat Intelligence

Malware and intrusion analysis published with the research team at Loginsoft — tracking how commodity loaders such as IcedID, Qakbot and Aurora are delivered and evolved.

Automation & Tooling

Small, focused tools that remove the repetitive parts of recon and analysis, plus data pipelines that turn raw market and telemetry data into something you can act on.

$ ls ./featured

CVE Research

All CVE analysis

$ tail -f ./threat-research.log

Taming the Storm: Understanding and Mitigating the Consequences of CVE-2023-27350

May 23, 2023 CVE-2023-27350Cl0pLockBitTrueBot

The world of cybersecurity is constantly evolving, with new threats emerging every day. One of the latest threats to emerge is the use of CVE-2023-27350 by threat actors to gain initial access to victim machines and servers. This vulnerability is found in the popular print management software, Papercut. In this blog post, we explore how the threat actors of Cl0p, Lockbit and Truebot malware are exploiting this vulnerability, and Osquery detections to safeguard from the risks it poses to businesses and organizations.

Read article

IcedID Malware: Traversing Through its Various Incarnations

May 02, 2023 IcedIDMalwareOsqueryCo-author: Bhargav

IcedID, the notorious malware, is actively involved in several delivery campaigns, demonstrating versatility and adaptability. The latest IcedID variants indicate the malware's continuous evolution, and the need for robust cybersecurity measures.

Read article

From Innocence to Malice: The OneNote Malware Campaign Uncovered

Mar 30, 2023 QakbotAgentTeslaAsyncRATRedlineIcedIDEmotetQuasar

OneNote has been highly cherished by Threat Actors (TAs) in recent months. Unfortunately, many malware distributors have taken notice and are now using OneNote to deliver malicious files to their victims. These actors attach malicious files to a page within OneNote and then share them with their targets as a .one file. The ONE file reaches its targets through phishing emails. Upon opening the attachment, the victim's computer is compromised.

Read article

Aurora: The Dark Dawn and its Menacing Effects

Mar 24, 2023 AuroraStealerMalwareRedline

Aurora Stealer, a non-friendly program in your neighborhood, is developed in Go-lang. The malware was developed for threat actors to steal victims' sensitive data. Since its initial release, there have been many adaptations of the malware. It started as a botnet having info-steaker capabilities but currently it is a full-time info-stealer which is being sold by the threat actor labelled Cheshire on Russian speaking dark-net forums mentioned by cybersecurity firm Sekoia.

Read article

$ contact --info

Open to security research roles, freelance assessments, and collaboration on tooling or interesting problems. The fastest way to reach me is email.