RPRudra Ponksheinblog.realrudrap.dev·5d ago · 7 min readThe Attacker's DisciplineThere is a specific kind of cognitive dissonance that comes from reverse engineering a malware sample in one terminal while your own app's backend runs in another. I spent the better part of the last 30
RPRudra Ponksheinblog.realrudrap.dev·Jul 8 · 11 min readI Found the Live C2 Server Controlling Thousands of Infected DevicesIf you've been following along, here's where we are: a spam SMS dropped an APK, the APK was a dropper that XOR-decrypted a multi-DEX container, HMAC-validated it, AES-decrypted it, and loaded the resu20
RPRudra Ponksheinblog.realrudrap.dev·Jun 26 · 16 min readThe Media Player that wasn'tContinuing from the first part of the series, where I left off with the DEX file from r_4dfb.bin, it claimed to be a media player. Spoiler alert, it wasn't, and it never was Cracking the container He30
RPRudra Ponksheinblog.realrudrap.dev·Jun 24 · 15 min readThe Spam SMS that turned into a rabbit hole⚠ WARNING: If you received a SMS claiming your vehicle has an outstanding RTO challan with a link which downloads an .apk file, do not open it. This is an active malware campaign as of June 2026 imper30
RPRudra Ponksheinblog.realrudrap.dev·Nov 28, 2025 · 8 min readHow I use AI in my Dev Workflow (without losing control)While building Poseidon, a custom CTF focused container orchestrator and deploying OrcaCTF on AWS, Sumit asked how I incorporate AI into my development workflow. As I explained my process, I realized I’ve subconsciously developed a systematic framewo...00
