Research & publications
Frontier Labs is the umbrella; Novich0k is the flagship track. This page carries the rest of the lab's work and the citable record of it.
VileBlood: process fragmentation
A companion track in endpoint research: if an implant's duties never live in one process, no single memory image tells the whole story.
The concept. Endpoint detection correlates behavior within a process: memory content, API calls, network activity. VileBlood models an implant fragmented into three isolated processes (Network, Crypto, Execution), each holding minimal privileges and only its own slice of state, communicating over local-only channels with per-boot ephemeral keys.
Why it matters. Memory scanning finds a network client with no keys, a crypto worker with no network, or an executor with neither. The forensic whole exists nowhere at once.
FULL ANALYSIS · Read the Vileblood research page · Original Medium article
Detection counterpart
Fragmentation trades memory visibility for relationship visibility. Cross-process correlation (three same-user processes born together,, exchanging local procedure calls in lockstep) is itself a signal. Handle analysis, ALPC monitoring, and parent-child timing make the fragments legible as a set. The evasion moves the defender's unit of analysis from the process to the relationship graph.
Publications
Long-form writeups live on Medium. Five pieces carry the research record so far.
VileBlood: Cryptographic Process Fragmentation and the End of Monolithic C2
Why the next generation of command-and-control infrastructure will make modern forensic reconstruction impossible.
Read on MediumHow Do C2s Get Away with Murder?
A cryptographic thought experiment: the perfect crime has no trace and no trail.
Read on MediumIntroducing Enterprise ReconWare
Technical analysis of ZoomInfo Community Edition: an installer whose behavior extends far beyond its stated purpose.
Read on MediumThere Is No Handshake
Relayed, fragmented, recombined: the proxy carries the message but never knows who whispered it.
Read on MediumStateless Routing with HMAC
A new layer of C2 discipline: session management for cryptographically segregated infrastructure.
Read on MediumCode
The GitHub profile hosts research tooling: analysis and detection-support frameworks. Consistent with this site's scope discipline, no deployable C2 artifacts are published or linked anywhere on this site.