Arifian Zaki Az Zuhdi
@ZhaxstronautCybersecurity graduate from Universitas Bina Nusantara with 1 year of professional internship experience as a SOC Analyst and Threat Intelligence Analyst at Lintasarta, covering alert triage and incident response for security operations, alongside dark web monitoring and MITRE ATT&CK-based threat assessments for financial-sector clients. Complements this with hands-on offensive-security practice, including bug bounty programs, CTF challenge design at a national-level contest, and continuous training on Hack The Box and similar platforms, to better understand attacker behavior and sharpen detection and investigation skills.
Actively exploring the intersection of AI and security, including AI-powered security tools and AI-specific security risks. Undergraduate thesis focused on secure AI-driven adversary emulation, implemented as a MITRE Caldera plugin (Seed & Vine). Co-authored a peer-reviewed paper and recipient of the Best Paper Award at IEEE ICoDSA 2025 for research on AI-driven IAM security.
Experience
Professional and project work
Threat Intelligence Analyst Intern
PT Aplikanusa Lintasarta ↗- Contributed to daily, weekly, and monthly threat intelligence reporting for multiple clients
- Conducted dark web monitoring and issued critical early warning reports with IOC packages
- Performed deep-dive threat assessments on active ransomware and supply chain attack campaigns
- Produced Proof of Concept reports integrating multi-platform intelligence to demonstrate attack surface risks
- Mapped adversary tactics using the MITRE ATT&CK framework to provide actionable SOC detection guidance
SOC Analyst Intern
PT Aplikanusa Lintasarta ↗- Analyzed security alerts to verify true positives and produced daily incident reports
- Triaged incidents by designing standardized response playbooks for common security alarm scenarios
- Investigated traffic data using pivot tables to identify top threat names and actions
- Formulated actionable security recommendations and remediation reports to enhance network defense effectiveness
Bug Bounty Program
Panin Dai-ichi Life ↗- Identified and responsibly disclosed four vulnerabilities in production systems through structured vulnerability assessment and reporting
Network Support Engineer Intern
RSUD dr. Soeselo ↗- Set up and maintained IT infrastructure (networks, systems, hardware) for hospital operations, providing technical support and troubleshooting
Networking Trainer
IDN Mengajar — IDN Boarding School ↗- Delivered networking training (MikroTik, Cisco, fiber optic/FTTH) to students and educators as part of an SMK outreach program
Technical Skills
Tools and technologies I work with
- OSINT
- Dark Web Monitoring
- IOC Analysis
- MITRE ATT&CK
- Attack Surface Management
- Threat Intel Platforms
- Incident Response
- Log Analysis
- Traffic Analysis
- LogRhythm (SIEM)
- Alert Investigation
- IOC Analysis
- Burp Suite
- Nmap
- Metasploit
- Vulnerability Assessment
- OWASP Top 10
- Kali Linux
- Linux
- Python
- Bash
- Git & GitHub
- Docker
- API Integrations
- Neuro Symbolic
- DSPy
- MCP
- LiteLLM
- MLflow
- ChromaDB
- AI Agent
- Claude
- Gemini
- Routing & Switching
- TCP/IP & Subnetting
- MikroTik
- Cisco
- Wireshark
- Network Troubleshooting
Featured Work
Projects, writeups, and research
Seed & Vine: Safe Autonomous Adversary Emulation via Neuro-Symbolic AI & Model Context Protocol
Development of the Seed & Vine plugin for MITRE Caldera to mitigate Excessive Agency and PII leakage using Neuro-Symbolic AI, Model Context Protocol (MCP), Tiered Pseudonymization, HITL Approval Gate, and 3-Layer FSM.
Cyber Threat Intelligence Research: UNC6395 (GRUB1) Salesloft Drift Supply Chain Attack
Cyber threat intelligence analysis report on UNC6395 (GRUB1) Salesloft Drift SaaS supply chain attack, covering OAuth 2.0 token harvesting, Salesforce Bulk API 2.0 mass exfiltration, MITRE ATT&CK mapping, and mitigation tactics.
ATIA-X: A Zero-Cost Automated Threat Intelligence Aggregator
A free, self-built CTI system that monitors ransomware activity, vulnerability disclosures, and Indonesia-specific threats, then delivers them straight to Telegram and email, built during my internship to solve my own need for timely threat visibility.
Cyber Threat Intelligence Research: UNC3886 China-Nexus APT Cyber Espionage
Cyber threat intelligence analysis report on UNC3886 APT Group (China-Nexus), covering zero-day exploitation across Fortinet, VMware ESXi/vCenter, and Junos OS, VIB/hypervisor malware architecture, MITRE ATT&CK mapping, and indicators of compromise.
Cyber Threat Intelligence Research: LockBit 5.0 Ransomware Group
Cyber threat intelligence analysis report on LockBit 5.0 Ransomware Group, covering threat actor profiling, dark web cartel coalitions, double/triple extortion, MITRE ATT&CK mapping, confirmed vulnerabilities, and mitigation strategies.
BlueSky Ransomware: A Digital Forensics Kill Chain Reconstruction
A network and log forensics investigation reconstructing a full ransomware kill chain, from SQL Server brute force to C2 infrastructure and lateral movement tooling, based on a CyberDefenders DFIR challenge.
Academic
Education and research focus
Cyber Security
Universitas Bina Nusantara, Bachelor of Computer Science ↗- Thesis: AI-driven adversary emulation, an autonomous, human-supervised cyberattack simulation implemented as a MITRE Caldera plugin, validated in a controlled lab environment.
- Co-authored and presented research on AI-enhanced Identity and Access Management (IAM) at IEEE ICoDSA 2025
- Active member of the Cyber Security Community (CSC) Binus, contributing to research and development activities
Computer Network Engineering
IDN Boarding School, Vocational High School Diploma ↗- Foundation in computer networking (MikroTik, Cisco, fiber optic/FTTH), also applied as a Networking Trainer for the IDN Mengajar outreach program.
Communities
Organizations and campus involvement
Cyber Security Community (CSC) Binus
Research and Development Division ↗- Designed and developed a web exploitation CTF challenge for CSC CTF Contest 2024, testing participants' ability to exploit insecure JavaScript execution to access a sensitive flag file
- Served as Secretary for LDKCP CSC 2024, coordinating internal communication and documentation across the organization
Certifications
Professional credentials and training
Publications
Research and academic writing
Automated IAM Permission Management with AI Integration for Optimized Security
Proposed an AI-enhanced approach to Identity and Access Management (IAM), validated using a real-world ransomware case study.
IMPLEMENTATION OF NEURO-SYMBOLIC ARCHITECTURE BASED ON MODEL CONTEXT PROTOCOL FOR ENHANCING ADVERSARY EMULATION ADAPTABILITY IN MITRE CALDERA
AI-driven adversary emulation framework built as a MITRE Caldera plugin, simulating real-world attack techniques in a human-supervised, controlled lab environment.