terminal

$ whoami

Võ Trọng Đức

$ cat role.txt

Security Engineer | Automation Specialist

$ echo $STATUS

Available for opportunities

Open to Work

Security · Full-Stack · AI · CTF

Võ Trọng Đức

Security Engineer | Automation Specialist

Building secure systems and automating complex workflows. Passionate about threat detection, algo-trading, and CTF challenges.

View Projects CTF Write-ups

About Me

Security-focused engineer with a passion for building automated solutions and tackling complex cybersecurity challenges. Currently pursuing Information Assurance at FPT University while working on real-world security projects.

Experienced in SOC operations, network intrusion detection, and developing automation tools. Active CTF competitor with expertise in forensics, reverse engineering, and web exploitation.

Ho Chi Minh City FPT University votrongduc0811@gmail.com

10+

Projects

10+

CTF Write-ups

3.2

GPA

Certifications

Technical Arsenal

Security & Defense

Suricata ELK Stack Wireshark Volatility IDA Pro MITRE ATT&CK YARA Rules SOC Operations

Development

Python TypeScript JavaScript Next.js / React FastAPI Bash SQL C/C++

AI / Machine Learning

Scikit-learn XGBoost Pandas NumPy Feature Engineering

Infrastructure & Tools

Docker PostgreSQL Redis Cloudflare Vercel Prisma / Drizzle Linux Git Telegram API Selenium

Engineering Projects

Click on a card to view detailed information

Security · AI

CyberPulse

Real-time cybersecurity intelligence platform aggregating 32+ trusted sources. AI-powered pipeline (Anthropic Claude) automates CVE enrichment with NVD/CISA/EPSS data, generates bilingual EN/VI threat reports, and delivers daily newsletters — all on a fully Dockerized async stack.

Python · FastAPI · Celery Next.js 14 Claude AI PostgreSQL · Redis Docker

32+

Trusted Sources

EN/VI

AI Threat Reports

Security

SentinelSOC

Enterprise-grade SOC analyst platform: 10 MITRE ATT&CK-mapped detection rules, 6 IR playbooks, forensic analysis tools, and 90+ analyst training scenarios — with real-time WebSocket alerting and one-command Docker deploy.

React 18 · TypeScript FastAPI MITRE ATT&CK WebSocket

ATT&CK Rules

90+

Training Scenarios

Security

Hybrid NIDS

An advanced hybrid NIDS combining Suricata signature-based detection with Machine Learning anomaly detection. Trained on CICIDS2017 with XGBoost achieving 99.46% accuracy. Features 8-step closed-loop detection, behavioral analysis, and real-time Telegram alerting.

ELK Stack Machine Learning MITRE ATT&CK Python

99,46%

Detection Accuracy

< 2s

Response Time

Intelligence

XFEED

Real-time X/Twitter intelligence platform monitoring financial influencers, market news, and economic events. Production-grade anti-detection engine with zero-auth public REST API.

Python curl_cffi GraphQL REST API

OSINT

InsightHive

Social media intelligence platform for collecting, analyzing, and visualizing data from Facebook & TikTok at scale. Features automated data pipelines, trend analysis, and interactive dashboards.

Python Selenium Data Analysis OSINT

Platforms

Real-time

Analysis

Malware Research

Snake Game Keylogger

Proof-of-concept malware analysis lab simulating a full attack lifecycle: phishing delivery, credential harvesting, persistence, and C2 exfiltration via Telegram.

MITRE ATT&CK Python Credential Theft C2

ATT&CK Techniques

Full

Kill Chain

Full-Stack · Production

HIEN ERP

Production ERP for Hiên Concept & Củi Lũ Concept ceramic workshops (HCMC). Manages bookings, production workflow, shipping, and revenue — on Cloudflare Pages + D1 with 5-role RBAC.

Next.js 16 Drizzle · D1 Cloudflare TypeScript

Workshop Brands

Edge

DB at Edge

Full-Stack · SaaS

Xperise BD CRM

Internal CRM replacing 426-contact Excel sheets for Xperise's BD team. Turborepo monorepo (Next.js + Fastify), 7-stage deal pipeline, 4-role RBAC, BullMQ email campaign queue, and Apollo.io enrichment.

Turborepo Next.js · Fastify Neon PostgreSQL BullMQ · Redis

426+

Contacts Migrated

BD Staff Roles

Full-Stack

Personal Finance

Multi-user finance platform with 60+ categories, multi-currency live exchange rates, budget alerts, and recurring transaction automation. Bilingual VI/EN, PDF + Excel export. Free-tier deploy on Vercel + Supabase.

Next.js · Prisma Supabase shadcn/ui Recharts

60+

Default Categories

VI/EN

Bilingual

AI · Automation

Marketing Automation

Server-side image composition engine for multinational marketing campaigns. Processes batch template rendering via Sharp, integrates AI content generation (Vercel AI SDK v6), and automates campaign scheduling through configurable async concurrency pipelines — built for a live corporate client.

Next.js 15 Sharp Vercel AI SDK v6 TypeScript

Automation

Prospire Algo-Trading

High-frequency cryptocurrency trading engine with custom signal algorithms, real-time market data pipelines, and automated trade execution across multiple exchanges.

Python WebSocket Async I/O

$100k

/week volume

Financial Telegram Bot & Data Pipeline

Production Telegram bot serving real-time financial statements for 1,600+ Vietnamese listed companies. Built with producer-consumer architecture and async web scraping for high-throughput data delivery to investors.

Telegram API Producer-Consumer Selenium BeautifulSoup

CTF Vault

Click on a card to view detailed information

Forensic Hard

Gimme Your Point

SharePoint CVE-2025-49704 exploitation chain: deserialization RCE to Chrome credential theft via IDA reverse engineering

Forensic Medium

FOR2 - ICMP Backdoor

Covert C2 communication via ICMP protocol with command execution and data exfiltration through ping packets

Reverse Medium

RE02 - Excel Macro

Obfuscated XLM 4.0 macro reverse engineering with olevba deobfuscation and cross-cell string reconstruction

Reverse Hard

EzLogic

Hardware logic gate analysis with Verilog testbench modification and position-based brute-force decryption

Forensic Medium

Easy Forensics

Windows memory dump analysis with Volatility to identify fileless malware persistence via Registry Run keys

Forensic Easy

Known Unknowns

Audio steganography via spectrogram analysis using Sonic Visualiser to reveal frequency-hidden text

Forensic Hard

tet-riffic!

USB HID keystroke extraction from PCAP driving a Tetris game that renders a QR code containing the flag

Forensic Easy

St3g0

Least Significant Bit steganography extraction from PNG using zsteg bit-plane analysis

Forensic Easy

Verify

SHA-256 file integrity verification to identify the correct file among thousands of decoys

Forensic Medium

m00nwalk

Slow Scan Television (SSTV) signal decoding from audio to reconstruct Apollo-era transmitted images

Experience

Viettel IDC

Jul - Oct 2025

Security Engineer Intern (SOC)

SOC operations, threat hunting, and developing automation tools for security monitoring using ELK Stack.

Prospire

May 2025 - Present

Co-Founder & Founding Engineer

Building automated crypto trading systems and developing high-frequency trading algorithms with real-time market data processing.

HPT Vietnam Corporation

Dec 2023 - Apr 2024

Security Training Program

Intensive security training covering penetration testing, incident response, and security analysis methodologies.

Certifications

Partner Cloud Security

Cloud Security

Cisco

CyberOps Associate

Security Operations

Cisco

On-Job Training

Security Training

HPT Vietnam Corporation

Introduction to Networks

CCNAv7

Cisco

Switching, Routing, Wireless

CCNA

Cisco

Honorable Student

Fall 2023

FPT University

Honorable Student

Fall 2024

FPT University

Honorable Student

Spring 2025

FPT University

Get in Touch

Let's Connect

Open to security engineering roles, research collaborations, and CTF team invitations. Feel free to reach out.

Email votrongduc0811@gmail.com

GitHub Matth3wV0

LinkedIn votrongduc

Ready to Collaborate?

Whether it's securing infrastructure, building automation pipelines, or competing in CTFs - I'm always up for a challenge.

Send a Message

Technique ID	Name	Description
`T1027`	Obfuscated Files or Information	Custom logic encoding
`T1140`	Deobfuscate/Decode	Position-based decryption

Technique ID	Name	Description
`T1547.001`	Registry Run Keys	Persistence via startup registry
`T1027`	Obfuscated Files	Base64 encoded payload
`T1059.001`	PowerShell	Fileless execution

Technique ID	Name	Description
`T1001.002`	Data Obfuscation: Steganography	Data hidden in audio frequency
`T1027`	Obfuscated Files	Visual encoding in spectrograms

Technique ID	Name	Description
`T1056.001`	Keylogging	USB HID keystroke capture
`T1001.002`	Steganography	QR code hidden in game
`T1027`	Obfuscated Files	Data encoded in Tetris patterns

Technique ID	Name	Description
`T1001.002`	Steganography	LSB encoding in images
`T1027`	Obfuscated Files	Hidden data in image bits

Technique ID	Name	Description
`T1027`	Obfuscated Files	Flag hidden among decoys
`T1140`	Deobfuscate/Decode	Hash-based file identification

Technique ID	Name	Description
`T1001.002`	Steganography	Data encoded in audio
`T1027`	Obfuscated Files	SSTV signal encoding

Technique ID	Name	Observed Activity
`T1190`	Exploit Public-Facing Application	SharePoint CVE-2025-49704 deserialization via `MSOTlPn_DWP`
`T1059.001`	PowerShell	Payload staging via `Invoke-WebRequest` + `certutil` chain
`T1140`	Deobfuscate/Decode Files	Double `certutil -decode` to reconstruct executable from certificate blob
`T1555.003`	Credentials from Web Browsers	Chrome `Login Data` (SQLite) and `Local State` (encryption key) theft
`T1560.001`	Archive Collected Data	Password-protected ZIP creation for collected credentials
`T1041`	Exfiltration Over C2 Channel	HTTP POST multipart upload to attacker server
`T1070.004`	File Deletion	Self-cleanup of staging artifacts

Packet	Hostname	Content Type	Size	Filename
13	30.243.67.129	text/html	24 KB	`start.aspx`
22	30.243.67.129	application/x-www-form-urlencoded	4,221 bytes	`ToolPane.aspx`
383	30.243.67.128:1234	application/octet-stream	5,257 KB	`raw_package`
547	30.243.67.128:8000	multipart/form-data	299 KB	`upload`

Step	Action	Purpose
1	`Invoke-WebRequest` downloads `raw_package`	Retrieve disguised payload from C2
2	`Add-Content` appends Base64 padding + PEM trailer	Complete the fake certificate structure
3	First `certutil -decode` → `d1`	Strip PEM envelope, recover intermediate binary
4	Second `certutil -decode` → `health_check.exe`	Decode final executable
5	`del raw_package`, `del d1`	Anti-forensics: remove staging artifacts
6	Execute `health_check.exe`	Deploy credential stealer
7	`sleep 10`, then `del health_check.exe`	Allow completion, then destroy implant

Seq	Activity	Evidence
T+0	Crafted POST to `ToolPane.aspx` with deserialization payload	PCAP — Packet #22
T+1	SharePoint deserializes payload, executes PowerShell stager	Decoded CompressedDataTable
T+2	PowerShell downloads `raw_package` from C2	PCAP — Packet #383
T+3	Double `certutil -decode` reconstructs `health_check.exe`	PowerShell command analysis
T+4	Implant copies Chrome credentials, creates password-protected ZIP	Behavioral analysis
T+5	ZIP uploaded via POST to `30.243.67.128:8000/upload`	PCAP — Packet #547
T+6	Staging artifacts deleted	PowerShell command analysis

Technique ID	Name	Observed Activity
`T1095`	Non-Application Layer Protocol	ICMP used as C2 communication channel
`T1048.003`	Exfiltration Over Alternative Protocol	File data hidden within ICMP packet payloads
`T1041`	Exfiltration Over C2 Channel	Flag file extracted through the ICMP tunnel
`T1001`	Data Obfuscation	Flag encoded as ASCII art across multiple packets

Seq	Activity	Evidence
T+0	Attacker deploys `oci.bin` backdoor	Challenge artifacts
T+1	C2 command: `download C:\tmp\flag_1s_ck4mpj0n.txt`	ICMP Echo Request payload
T+2	Backdoor confirms: `openfile on remote computers success`	TCP stream
T+3	File contents exfiltrated as ASCII art across multiple packets	Packet payload analysis

Technique ID	Name	Observed Activity
`T1059.005`	Command and Scripting Interpreter: Visual Basic	XLM (Excel 4.0) macro execution
`T1204.002`	User Execution: Malicious File	User opens infected Excel document
`T1027`	Obfuscated Files or Information	String reversal and multi-cell fragmentation
`T1140`	Deobfuscate/Decode Files	Runtime string assembly from scattered cells
`T1036`	Masquerading	Decoy `calc.exe` execution

Tactic	Technique	Implementation
Initial Access	`T1566.001` Phishing: Spear-phishing Attachment	Malicious game distributed via email
Execution	`T1204.002` User Execution: Malicious File	Victim launches trojanized Snake game
Persistence	`T1547.001` Boot or Logon Autostart: Registry Run Keys	Script added to Windows Startup folder
Credential Access	`T1056.001` Input Capture: Keylogging	pynput library captures all keystrokes
Credential Access	`T1555.003` Credentials from Password Stores: Browsers	Chrome SQLite database decryption via AES
Exfiltration	`T1567.002` Exfiltration Over Web Service	Data sent to attacker via Telegram Bot API

Area	Task	Technical Detail
Data Preprocessing	CICIDS2017 Dataset	2.2M benign + 557k attack samples, balanced & cleaned
Feature Engineering	78 → 9 Features	Removed constant/correlated features, mapped to Suricata logs
Model Training	Ensemble ML	DT (20%) + RF (30%) + XGBoost (50%) weighted voting
Integration	Real-time Pipeline	Suricata eve.json → Feature Extraction → ML Inference

Model	Accuracy	Weight	Role
Decision Tree	99.19%	20%	Fast baseline detection
Random Forest	99.38%	30%	Balanced precision/recall
XGBoost	99.46%	50%	Primary detector, tuned via GridSearchCV

Attack Type	Detection Logic	Threshold
Port Scan	`ports_in_window / ips_in_window > 10`	score > 0.7
Host Scan	`ips_in_window / ports_in_window > 5`	score > 0.7
Brute Force	`auth_failures to same service > 3`	score > 0.7
Volume Anomaly	`bytes/sec > 1MB OR packets/sec > 1000`	score > 0.7

Võ Trọng Đức

About Me

Technical Arsenal

Security & Defense

Development

AI / Machine Learning

Infrastructure & Tools

Engineering Projects

CyberPulse

SentinelSOC

Hybrid NIDS

XFEED

InsightHive

Snake Game Keylogger

HIEN ERP

Xperise BD CRM

Personal Finance

Marketing Automation

Prospire Algo-Trading

Financial Telegram Bot & Data Pipeline

CTF Vault

Gimme Your Point

FOR2 - ICMP Backdoor

RE02 - Excel Macro

EzLogic

Easy Forensics

Known Unknowns

tet-riffic!

St3g0

Verify

m00nwalk

Experience

Certifications

Partner Cloud Security

CyberOps Associate

On-Job Training

Introduction to Networks

Switching, Routing, Wireless

Honorable Student

Honorable Student

Honorable Student

Get in Touch

Let's Connect

Ready to Collaborate?

Title

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)