Sam
Samdup is an information security researcher and digital security trainer based in Dharamsala, India. Originally from Tibet, he holds an M.Sc. in Computer Science from Bangalore, India and, a Master’s in Cybersecurity from Georgia Tech. His work focuses on malware analysis, memory forensics, incident response, threat hunting, and practical defensive security.
He/Him
Intervention
A targeted loader campaign first appeared as an AirJaldi firewall-update lure, then shifted delivery after responsible disclosure, and later reappeared as a Tibetan monastery archive and Dalai Lama teachings lure. The Windows loader copied itself as POWERFUL.exe, installed scheduled-task persistence, fetched a large encrypted second stage from blog.tibetanmonasteries.com, and executed it in process memory. This talk walks through the evidence chain: email headers, static analysis, Sysmon, pcaps, Volatility, x64dbg, Ghidra, and FLOSS. The final result is a recovered 36.7 MB Go PE with Sliver-style capability strings and a runtime Register object containing fish_tibet.
Note: AirJaldi is the ISP provider in and around the city I stay.