Hello — I’m Amirul Iman, a cybersecurity researcher based in South East Asia. I dig into real-world attacks: vulnerability research on financial and government targets, ransomware claims and data leaks, and the threat actors behind them.

This site is where the write-ups land — technical deep dives with code, timelines of incidents as they unfold, and regional context you won’t get from a generic CVE feed.

Recent writing

Sustained Web Attacks Against Malaysia’s Financial Sector Internet-facing services across Malaysia's banking, savings, investment/funds and government-linked services face sustained Layer 7 abuse. The question is whether controls hold while under attack. The Screenshot Exemption: Probing Malaysia’s ILMU Models Makin berisi, makin menunduk. My Local 7B Thinks Killing a Python Process Is a Crime Why I grade AI safety probes on a $0 local model, and what a murder of crows taught me about keyword benchmarks. Your Website Is a Casino on Google — and You Can’t See It Gambling pages are being served from the websites of a Malaysian political party, government agencies and a Singapore government sandbox — while the owners see nothing. Two Critical Access-Control Flaws in a Financial Institution’s Mortgage Portal Amirul Cyber's vulnerability research on a Malaysian financial institution's mortgage portal surfaced two Critical access-control flaws exposing full identity, bank, and property data.
View all posts →