
Rudra Ponkshe
Backend Developer | Cybersecurity Researcher
Gandhinagar, India
description: 'Android malware researcher and backend developer. I reverse-engineer threats, then build the infrastructure and tooling to study them properly — RE, threat intelligence, and systems that survive contact with real-world abuse, not just clean-room demos.'
package main
type Profile struct {
Name string
Focus []string
Skills []string
Interests []string
}
type TechStack struct {
DevOps []string
Backend []string
Frontend []string
}
type ContactType string
const (
GitLab ContactType = "gitlab"
Twitter ContactType = "twitter"
LinkedIn ContactType = "linkedIn"
Email ContactType = "email"
)
var techStack = TechStack{
DevOps: []string{
"GitLab",
"Cloudflare",
"Docker",
"Azure",
},
Backend: []string{
"Go",
"PostgreSQL",
"Firebase",
"gRPC",
},
Frontend: []string{
"React",
"TypeScript",
"Kotlin",
"Jetpack Compose",
"RoomDB",
"WorkManager",
},
}
var me = Profile{
Name: "Rudra Ponkshe",
Focus: []string{
"Android Malware Analysis",
"Reverse Engineering",
"Threat Intelligence",
},
Skills: append(append(append([]string{},
techStack.DevOps...),
techStack.Backend...),
techStack.Frontend...),
Interests: []string{
"Malware Research",
"Reverse Engineering",
"Security",
"Privacy",
"Self-Hosting",
"Networking",
},
}
// I don't just study systems; I build the ones I break them with.
// Backend and infra work funds and feeds the research: every tool
// I write exists to make the next sample easier to take apart.
// Contact returns the URL for a given contact type
func Contact(t ContactType) string {
switch t {
case GitLab:
return "https://gitlab.com/realRudraP"
case Twitter:
return "https://x.com/realRudraP"
case LinkedIn:
return "https://www.linkedin.com/in/rudraponkshe"
case Email:
return "hello@realrudrap.dev"
default:
return "Send carrier pigeon."
}
}Sealed With a KYSS
Deep dive into an Android banking RAT — static and dynamic analysis of its capabilities, C2 behavior, and evasion techniques.
Read on Stack UnwindNot (a) Fine.
Multi-part investigation into an eChallan-themed smishing campaign — from initial lure to payload analysis across four stages of the attack chain.
Read Part 1Caught in the Reeloop
Analysis of a primary dropper app used to deliver NightPlay and other second-stage payloads, examined on rooted-device infrastructure.
Read on Stack UnwindPoseidon
Distributed container orchestration engine for CTF competitions. Master-worker architecture with an HTTP/gRPC control plane for challenge scheduling, and drain-aware AWS auto scale-in/out validated on EC2 t2.micro (1→2 nodes under load, sustaining 20 concurrent containers). Built as the orchestration backbone for OrcaCTF — a full CTF platform integrating the engine with a frontend and challenge set, using Traefik routing and Prometheus/Grafana observability.
Vault
Encrypted interactive file vault written in C++. AES-GCM encryption via OpenSSL, splitting files into 5MB chunks across storage directories for obfuscation — a 2GB file encrypts in 25-30s and decrypts in 35-40s on consumer hardware. Persistent encrypted metadata and secure multi-pass deletion configurable by pass count, modeled on the US Army AR 380-19 standard.
View on GitLabTijori
QR-based cashless payment platform for university events. Validated across 35 test accounts, designed for 550+ attendees and 15-20 vendors over a 5-hour event window. ACID-compliant transactions under concurrent load, with JWT session auth that withstood informal bypass attempts and separate student/vendor interfaces backed by real-time SSE verification.
Beacon
Full-stack attendance and workforce management system, currently in active production use on a 4-employee farm pilot. Go backend rewrite (sqlc/pgx, chi router, goose migrations) with JWT refresh token rotation, RBAC, and audit logging. Offline-first Android client with GPS-verified selfie clock-in, WorkManager-scheduled sync, and OTA-configurable geofencing. Open-source release planned.
View on GitLabNFSU, Gandhinagar
BTech-MTech CS (Cybersecurity)
Aug 2022 – Aug 2028 · SPI 9.1
Certifications
- ▸ ISC2 Certified in Cybersecurity (CC)
- ▸ AWS Cloud Foundations
- ▸ Fortinet Certified Associate – Cybersecurity
- ▸ CDAC Windows Forensics Analysis Bootcamp — Thiruvananthapuram