Sergei Shevchenko Email & Phone Number

Sydney, New South Wales, Australia

Sydney, New South Wales, Australia

■ Acquired by AlgoSec in 2022■ Full-stack development of Prevasio CSPM: ◦ Prevasio CSPM scanner for AWS, Azure, and GCP ◦ Dynamic analysis sandbox for containers ◦ Prevasio CSPM dashboard (the web application)■ Sunburst Backdoor: A Deeper Look Into The SolarWinds' Supply Chain Malware ◦ https://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html■ Operation ‘Red Kangaroo’: Industry’s First Dynamic Analysis of 4M Public Docker… Show more ■ Acquired by AlgoSec in 2022■ Full-stack development of Prevasio CSPM: ◦ Prevasio CSPM scanner for AWS, Azure, and GCP ◦ Dynamic analysis sandbox for containers ◦ Prevasio CSPM dashboard (the web application)■ Sunburst Backdoor: A Deeper Look Into The SolarWinds' Supply Chain Malware ◦ https://blog.prevasio.com/2020/12/sunburst-backdoor-deeper-look-into.html■ Operation ‘Red Kangaroo’: Industry’s First Dynamic Analysis of 4M Public Docker Container Images ◦ https://prevasio.com/red-kangaroo■ Router Honeypot for an IRC Bot ◦ https://blog.prevasio.com/2020/09/a-router-honeypot-for-irc-bot_18.html■ Kinsing Punk: An Epic Escape From Docker Containers ◦ https://blog.prevasio.com/2020/08/kinsing-punk-epic-escape-from-docker.html Show less

Sydney, Australia

Leading a global team of cyber-threat researchers, focused on Android, Linux, and macOS platforms.■ ‘Cloud Snooper’ Attack Bypasses Firewall Security Measures ◦ https://news.sophos.com/en-us/2020/02/25/cloud-snooper-attack-bypasses-firewall-security-measures/■ Never before had Stierlitz been so close to failure ◦… Show more Leading a global team of cyber-threat researchers, focused on Android, Linux, and macOS platforms.■ ‘Cloud Snooper’ Attack Bypasses Firewall Security Measures ◦ https://news.sophos.com/en-us/2020/02/25/cloud-snooper-attack-bypasses-firewall-security-measures/■ Never before had Stierlitz been so close to failure ◦ https://www.virusbulletin.com/blog/2019/12/vb2019-paper-never-had-stierlitz-been-so-close-failure-or-what-soviet-super-spy-doing-popular-bundleware-mac/■ VPNFilter botnet: a SophosLabs analysis ◦ https://news.sophos.com/en-us/2018/05/24/vpnfilter-botnet-a-sophoslabs-analysis/ ◦ https://news.sophos.com/en-us/2018/05/27/vpnfilter-botnet-a-sophoslabs-analysis-part-2/ Show less

Sydney, Australia

Cyber Research & Software Engineering Lab Manager, 2012-2015Malware Analysis & Reverse Engineering ■ Discovery of the malware that targets SWIFT network, the first malware of its kind ◦ http://baesystemsai.blogspot.com/2016/04/two-bytes-to-951m.html ■ Discovery of the link between the Lazarus group and the Bangladesh heist ◦ http://baesystemsai.blogspot.com/2016/05/cyber-heist-attribution.html ■ Investigation of other incidents with… Show more Cyber Research & Software Engineering Lab Manager, 2012-2015Malware Analysis & Reverse Engineering ■ Discovery of the malware that targets SWIFT network, the first malware of its kind ◦ http://baesystemsai.blogspot.com/2016/04/two-bytes-to-951m.html ■ Discovery of the link between the Lazarus group and the Bangladesh heist ◦ http://baesystemsai.blogspot.com/2016/05/cyber-heist-attribution.html ■ Investigation of other incidents with SWIFT ◦ http://baesystemsai.blogspot.com/2017/10/taiwan-heist-lazarus-tools.html ■ Developing a sinkhole for QBot; deploying the sinkhole at the Royal Melbourne Hospital to serve back ‘uninstall’ command — full remediation of the QBot infection at the hospital ◦ https://media.scmagazine.com/documents/225/bae_qbot_report_56053.pdf ■ Analysis, reverse engineering, and publication of the analysis tools and whitepapers on various malware, such as Shylock, Snake, TDL4, Wipbot, Cozy, Dyre, Dridex, APT10 / CloudHopper / RedLeaves, Alibaba / OpCleaver, WannaCry and many other ◦ http://artemonsecurity.com/snake_whitepaper.pdf ◦ http://baesystemsai.blogspot.com/2017/05/wanacrypt0r-ransomworm.htmlReverse Engineering Instructor ■ BAE Systems Detica Cyber Academy — development of the Malware Analysis & Reverse Engineering Course; delivery of the course to Australian Federal Police in Canberra, Sydney and Melbourne (~70 students) ■ Presenting threat analysis at multiple conferences and client briefings, such as: ◦ Snake / Uroboros: AISA conferences in Sydney and Canberra, 2013-2015 ◦ Financial Malware: Talentum Events in Helsinki, Finland, November 2015 ◦ Shylock: Security Analyst Summit, Tenerife, February 2016 ◦ SWIFT Malware: GovWare, Business Defence Forum, Singapore, 2016 ◦ Lazarus Group: Security Analyst Summit, Sint Maarten, April 2017 ◦ Cyber Security & Payments Fraud, SWIFT Business Forum, Sydney, June 2017 Show less

Sydney, Australia

Malware Analysis & Reverse Engineering ■ Advanced threat / vulnerability research: blog.threatexpert.com ■ Staff training: Malware Research Centre, PC Tools, Sydney ■ Discovery / analysis of several high-profile threats: ■ Agent.BTZ – A Threat That Hit Pentagon ◦ http://blog.threatexpert.com/2008/11/agentbtz-threat-that-hit-pentagon.html ■ Rustock.C – Unpacking a Nested Doll ◦… Show more Malware Analysis & Reverse Engineering ■ Advanced threat / vulnerability research: blog.threatexpert.com ■ Staff training: Malware Research Centre, PC Tools, Sydney ■ Discovery / analysis of several high-profile threats: ■ Agent.BTZ – A Threat That Hit Pentagon ◦ http://blog.threatexpert.com/2008/11/agentbtz-threat-that-hit-pentagon.html ■ Rustock.C – Unpacking a Nested Doll ◦ http://blog.threatexpert.com/2008/05/rustockc-unpacking-nested-doll.html ■ Hydraq, a.k.a. Aurora ◦ http://blog.threatexpert.com/2010/01/trojanhydraq-exposed.html ◦ http://blog.threatexpert.com/2010/01/trojanhydraq-part-ii.html ◦ https://www.symantec.com/connect/blogs/trojanhydraq-incidentSoftware development: ■ A number of key modules of the scan engine ■ Threat Removal Tool ■ Installer protector ■ Numerous features and improvements for the main product line Show less

Sydney, Australia

Founder / Inventor ThreatExpert - Automated Threat Analysis system (US Patent 20070283192): ■ Acquisition of ThreatExpert by PC Tools, 2006 ■ Acquisition of PC Tools by Symantec, 2008

Sydney, Australia

Malware Analysis & Reverse Engineering: ■ Malware analysis: thousands of manually reverse-engineered samples ■ Write-ups, detection signatures, PE-file repair / disinfection p-code ■ Developer of the FixTool engine / builder, used in numerous threat removal tools with the millions of the registered downloads ■ One of the main contributors into Symantec online threat encyclopedia