Blog

Notes from the work

Incident response, testing, and practical security for small teams, written by the person who does the work.

A malware lab that never runs the malware

How I built a static-only reverse engineering lab in throwaway cloud machines, what each safety layer does and does not stop, and what broke on the first run.