Hey, I’m Ayansh Kumar, a cybersecurity researcher and former CTI analyst at Fortinet and CloudSEK. My work has focused on threat actors, malicious infrastructure, phishing operations, malware delivery, scams, and the ways attackers reuse infrastructure across campaigns.
During my time in threat intelligence, I researched campaigns ranging from phishing operations and malware infrastructure to OTP bots, compromised social-media accounts and broader threat-actor activity.
More recently, I’ve continued that work independently, including contributing research to an investigation by The420.in into a deepfake-driven investment scam targeting users in India.
But that’s the résumé version.
What I really enjoy is starting with one small piece of evidence and seeing where it leads. That process of following the connections is the part of threat intelligence I find most interesting.
I’m less interested in simply identifying that something is malicious than in understanding the relationships around it: who or what might be connected, what infrastructure is being reused, how an operation has changed over time, and what the available evidence actually allows us to say. And just as importantly, what it does not allow us to say.
That is why I started The Traceback.
The Traceback is where I document independent investigations, technical research, and shorter research notes about cybercrime and digital threats.
The idea is simple:
Start with the evidence. Follow the connections. See where they lead.
Selected work
Independent investigations and collaborations
Deepfake AI Trading Scam Investigation
I contributed research to a The420.in investigation examining a deepfake-driven investment scam and the infrastructure operating behind what victims were seeing on the surface. Read the investigation →
Research from my time at Fortinet and CloudSEK
- Phishing Campaign Targeting Mobile Users in India Using India Post Lures Read the research →
- How Threat Actors are Exploiting ChatGPT’s Popularity to Spread Malware via Compromised Facebook Accounts Read the research →
- Breaking into the Bandit Stealer Malware Infrastructure Read the research →
- The Rise of OTP Bots and SMS Senders in the Arsenal of Threat Actors Read the research →
- Connecting the Dots: Unveiling The Five Families’ Cyber Operations, Current Associations & Impact Read the research →
Speaking
I spoke at BSides Kerala 2025, presenting:
Welcome to the Dark Web: Where Your Data Has Already Checked In
In the media
My research has been covered by publications including TechRadar, The Economic Times, The Hindu BusinessLine, Business Standard, and The New Indian Express.
Elsewhere
You can find me on LinkedIn.
There is also a longer story about how I found my way into cybersecurity.
Earlier research, conference material and publications may appear under my previous name, Bablu Kumar.