Hello — I’m Amirul Iman, a cybersecurity researcher based in South East Asia. I dig into real-world attacks: vulnerability research on financial and government targets, ransomware claims and data leaks, and the threat actors behind them.

This site is where the write-ups land — technical deep dives with code, timelines of incidents as they unfold, and regional context you won’t get from a generic CVE feed.

Recent writing

Malaysia LHDN Tax Audit Phishing Campaign – Silver Fox (Oct 2026) Fake LHDN tax-audit wave, 26 October 2026. No credential form, one download button, ZIPs sideloading signed Windows binaries. 29 of 32 indicators unpublished; probable Silver Fox. IOCs and screenshots inside.... Sustained Web Attacks Against Malaysia’s Financial Sector Internet-facing services across Malaysia's banking, savings, investment/funds and government-linked services face sustained Layer 7 abuse. The question is whether controls hold while under attack. The Screenshot Exemption: Probing Malaysia’s ILMU Models Makin berisi, makin menunduk. My Local 7B Thinks Killing a Python Process Is a Crime Why I grade AI safety probes on a $0 local model, and what a murder of crows taught me about keyword benchmarks. Your Website Is a Casino on Google — and You Can’t See It Gambling pages are being served from the websites of a Malaysian political party, government agencies and a Singapore government sandbox — while the owners see nothing.
View all posts →