Profile picture Rudra Ponkshe

Rudra Ponkshe

Backend Developer | Cybersecurity Researcher

Gandhinagar, India

description: 'Android malware researcher and backend developer. I reverse-engineer threats, then build the infrastructure and tooling to study them properly — RE, threat intelligence, and systems that survive contact with real-world abuse, not just clean-room demos.'

package main

  type Profile struct {
      Name      string
      Focus     []string
      Skills    []string
      Interests []string
  }

type TechStack struct {
    DevOps   []string
    Backend  []string
    Frontend []string
}

type ContactType string

const (
    GitLab   ContactType = "gitlab"
    Twitter  ContactType = "twitter"
    LinkedIn ContactType = "linkedIn"
    Email    ContactType = "email"
)

var techStack = TechStack{
    DevOps: []string{
        "GitLab",
        "Cloudflare",
        "Docker",
        "Azure",
    },
    Backend: []string{
        "Go",
        "PostgreSQL",
        "Firebase",
        "gRPC",
    },
    Frontend: []string{
        "React",
        "TypeScript",
        "Kotlin",
        "Jetpack Compose",
        "RoomDB",
        "WorkManager",
    },
}


var me = Profile{
    Name: "Rudra Ponkshe",
    Focus: []string{
        "Android Malware Analysis",
        "Reverse Engineering",
        "Threat Intelligence",
    },
    Skills: append(append(append([]string{},
        techStack.DevOps...),
        techStack.Backend...),
        techStack.Frontend...),
    Interests: []string{
        "Malware Research",
        "Reverse Engineering",
        "Security",
        "Privacy",
        "Self-Hosting",
        "Networking",
    },
}

// I don't just study systems; I build the ones I break them with.
// Backend and infra work funds and feeds the research: every tool
// I write exists to make the next sample easier to take apart.

// Contact returns the URL for a given contact type
func Contact(t ContactType) string {
    switch t {
    case GitLab:
        return "https://gitlab.com/realRudraP"
    case Twitter:
        return "https://x.com/realRudraP"
    case LinkedIn:
        return "https://www.linkedin.com/in/rudraponkshe"
    case Email:
        return "hello@realrudrap.dev"
    default:
        return "Send carrier pigeon."
    }
}
Malware Analysis

Sealed With a KYSS

Deep dive into an Android banking RAT — static and dynamic analysis of its capabilities, C2 behavior, and evasion techniques.

Read on Stack Unwind
Blog Series

Not (a) Fine.

Multi-part investigation into an eChallan-themed smishing campaign — from initial lure to payload analysis across four stages of the attack chain.

Read Part 1
Dropper Analysis

Caught in the Reeloop

Analysis of a primary dropper app used to deliver NightPlay and other second-stage payloads, examined on rooted-device infrastructure.

Read on Stack Unwind

Poseidon

Distributed container orchestration engine for CTF competitions. Master-worker architecture with an HTTP/gRPC control plane for challenge scheduling, and drain-aware AWS auto scale-in/out validated on EC2 t2.micro (1→2 nodes under load, sustaining 20 concurrent containers). Built as the orchestration backbone for OrcaCTF — a full CTF platform integrating the engine with a frontend and challenge set, using Traefik routing and Prometheus/Grafana observability.

Vault

Encrypted interactive file vault written in C++. AES-GCM encryption via OpenSSL, splitting files into 5MB chunks across storage directories for obfuscation — a 2GB file encrypts in 25-30s and decrypts in 35-40s on consumer hardware. Persistent encrypted metadata and secure multi-pass deletion configurable by pass count, modeled on the US Army AR 380-19 standard.

View on GitLab

Tijori

QR-based cashless payment platform for university events. Validated across 35 test accounts, designed for 550+ attendees and 15-20 vendors over a 5-hour event window. ACID-compliant transactions under concurrent load, with JWT session auth that withstood informal bypass attempts and separate student/vendor interfaces backed by real-time SSE verification.

Beacon

Full-stack attendance and workforce management system, currently in active production use on a 4-employee farm pilot. Go backend rewrite (sqlc/pgx, chi router, goose migrations) with JWT refresh token rotation, RBAC, and audit logging. Offline-first Android client with GPS-verified selfie clock-in, WorkManager-scheduled sync, and OTA-configurable geofencing. Open-source release planned.

View on GitLab

NFSU, Gandhinagar

BTech-MTech CS (Cybersecurity)

Aug 2022 – Aug 2028 · SPI 9.1

Certifications

  • ▸ ISC2 Certified in Cybersecurity (CC)
  • ▸ AWS Cloud Foundations
  • ▸ Fortinet Certified Associate – Cybersecurity
  • ▸ CDAC Windows Forensics Analysis Bootcamp — Thiruvananthapuram