---
title: "Ilja Krasnjanski (@iljakrasnjanski) | Hashnode"
description: "Independent security researcher and systems engineer based in Berlin. Author of UNK_DeadDrop and unk-scanner. I write about static AST analysis, software sup..."
url: "https://hashnode.com/@iljakrasnjanski"
---

@iljakrasnjanski

# Ilja Krasnjanski

@iljakrasnjanski · Berlin · Joined November 2026

### [Where Overlord Ends and the Collection Toolchain Begins](https://unk-deaddrop.hashnode.dev/framework-and-collection-boundary?utm_source=hashnode&utm_medium=feed)

Overlord build metadata, browser-store selectors, wallet-upload markers and capture components in the Linux agent.

4 min read · [unk-deaddrop.hashnode.dev](https://unk-deaddrop.hashnode.dev/framework-and-collection-boundary?utm_source=hashnode&utm_medium=feed)

[Nov 2](https://hashnode.com/posts/framework-and-collection-boundary/6ae858e68c6d8126757aa628)

### [Building and Testing Detections for UNK\_DeadDrop](https://unk-deaddrop.hashnode.dev/detection-engineering?utm_source=hashnode&utm_medium=feed)

Thirty-three YARA rules replayed against retained artifacts, followed by a separate noise review and static scanner evaluation.

7 min read · [unk-deaddrop.hashnode.dev](https://unk-deaddrop.hashnode.dev/detection-engineering?utm_source=hashnode&utm_medium=feed)

[1](https://hashnode.com/posts/detection-engineering/6ae8581bb54b5d103cfc4d8c) [Nov 2](https://hashnode.com/posts/detection-engineering/6ae8581bb54b5d103cfc4d8c)

### [From Commit Metadata to a Developer Target List](https://unk-deaddrop.hashnode.dev/from-commit-metadata-to-a-developer-target-list?utm_source=hashnode&utm_medium=feed)

Reconstructing the harvester, sender configuration and aggregate counts behind two SQLite targeting pools. Original URL

7 min read · [unk-deaddrop.hashnode.dev](https://unk-deaddrop.hashnode.dev/from-commit-metadata-to-a-developer-target-list?utm_source=hashnode&utm_medium=feed)

[Nov 2](https://hashnode.com/posts/from-commit-metadata-to-a-developer-target-list/6ae8576be7c6a6cb29c6019a)

### [Following the GitLab Dead Drop: Configuration Changes and C2 History](https://unk-deaddrop.hashnode.dev/gitlab-dead-drop-infrastructure?utm_source=hashnode&utm_medium=feed)

How a GitLab-hosted configuration file let the UNK\_DeadDrop operators change servers without new payloads, and what its revision history reveals.

7 min read · [unk-deaddrop.hashnode.dev](https://unk-deaddrop.hashnode.dev/gitlab-dead-drop-infrastructure?utm_source=hashnode&utm_medium=feed)

[Nov 2](https://hashnode.com/posts/gitlab-dead-drop-infrastructure/6ae856129023a1bb138a08a5)

### [Parsing Without Executing: JavaScript Deobfuscation with Acorn](https://unk-deaddrop.hashnode.dev/parsing-without-executing-javascript-deobfuscation-with-acorn?utm_source=hashnode&utm_medium=feed)

Rebuilding an AES key from sixteen obfuscated fragments with Acorn, proven by authenticated decryption without running the extension.

6 min read · [unk-deaddrop.hashnode.dev](https://unk-deaddrop.hashnode.dev/parsing-without-executing-javascript-deobfuscation-with-acorn?utm_source=hashnode&utm_medium=feed)

[Nov 2](https://hashnode.com/posts/parsing-without-executing-javascript-deobfuscation-with-acorn/6ae853c154c30b1c838a4b10)