Investigations
Forensic audits andtechnology investigations.
Defensive security and forensic work by Jacob Durham: malware captured on my own sensors, enterprise incidents worked to closure, integrity audits of public records, and primary-source verification of published legal information. Every finding is published with its method and its limits.
Who does this work
All work on this page is done by one named person, under his legal name, through a registered 501(c)(3) public charity. These identifiers can be checked independently of this site.
- Investigator
- Jacob Durham (publishes as jacobrakai)
- Background
- U.S. Army veteran; almost twenty years in IT across networks, systems, and security
- Organization
- Jacobrakai Foundation, Washington nonprofit (UBI 605 728 469), EIN 33-3382083, 501(c)(3)
- ORCID
- 0009-0001-6897-8860
- linkedin.com/in/jacobjacobdurham
- GitHub
- github.com/jacobyoby
- Security contact
- [email protected]
Technology investigations: captures
Samples delivered to internet-exposed honeypot sensors I own and operate, analyzed statically. Indicators feed a free public blocklist.
01
RedTail brings its own key
296 sessions in which the RedTail botnet hands its victim a private key to pull the installer over SFTP. One key, three distribution servers, ten weeks.
Read →
02
Kill everything that deleted itself
A competitor killer that removes rival bots by a property, not a name, and would take down a patched server's services the same way.
Read →
03
A download server inside ip6.arpa
A loader that named its server in the IPv6 reverse-DNS tree, then switched to a raw IP the next day.
Read →
04
Three builds in twenty hours
Three builds of one bot compared string by string, each with more exploits than the last.
Read →
05
One login, one dropper
A seconds-long telnet session that fetched a shell dropper for fourteen CPU architectures, and the new blocklist tier it prompted.
Read →
06
Clean logs by design
A phishing redirector that hides its tracking identifier in the URL fragment, sent from a genuinely compromised mailbox that passed SPF, DKIM and DMARC.
Read →
07
A self-propagating Go ransomware worm
A stripped, obfuscated Go binary carrying its own scanner, SSH brute-forcer, encryptor and ransom note.
Read →
08
RedTail: one dropper, every architecture
Four UPX-packed ELF binaries delivered in one minute, one per architecture, with the family attribution labelled by strength of evidence.
Read →
Forensic audits: incident casework
Enterprise incidents I worked in early 2026, published with the organization, roles, dates and third-party victims anonymized. Each one reconstructs what happened from host and network artifacts and states what the evidence does not prove.
09
Hunting through Chrome Incognito
SRUM and DNS logs used to rebuild a 40-second malvertising chain when the browser kept no history.
Read →
10
Five stages of steganography
A RAT hidden in the red channel of a PNG, with execution proven from four independent registry and prefetch artifacts.
Read →
11
From phishing email to abuse reports
Header forensics separating a compromised mailbox from a spoofed one, and sandbox analysis of a weaponized ScreenConnect installer.
Read →
12
Dissecting a ScreenConnect phishing attack
A quarantined dropper recovered by brute-forcing a single-byte XOR, and SRUM used to show no data left the machine.
Read →
Forensic audits: public records
- Integrity audit of a municipal meeting recording (New Jersey, 2026). I tested a published recording of a virtual council meeting for edits. The meeting software's on-screen clock was read on every one of 40,746 frames and ran continuously, and the file matched the hosting platform's own thumbnail storyboard. Votes were attributed to speakers by OCR of the software's active-speaker label, and quorum was checked against the governing statute. Result: no edits found. Questions the recording cannot answer were routed to public-records requests rather than asserted.
- Primary-source verification of legal information. Every statute, court rule and form cited by the Foundation's court-form resources is checked against its primary source and recorded with its status and review date in the public table of authorities.
How the work is done
- Defensive only. Collection on decoy servers I own, static analysis of what they capture, and log correlation. Samples are never executed, and there is no offensive activity against anyone.
- Attribution stops at infrastructure. A rented server identifies a box, not a person.
- Corrections stay visible. Errors are corrected in place with the correction shown; see the research index for the ones on record.
- Disclosure is deliberate. Abuse reports, sample submissions and blocklist entries are made by a named person, against sustained activity, and reversibly where possible.