Notes from the work.
Writing on how systems get specified, built and defended. Research published through IGRS, the director’s open investigation resource, alongside notes from our own engagements.
FeaturedThreat intel · 28 Sep 2026 · 7 min
The invitation is an APK
Read the article →
How wedding cards and traffic challans became India’s most personal malware, and what an investigation has to capture.
Threat intelDunimeThe invitation is an APKHow wedding cards and traffic challans became India’s most personal malware, and what an investigation has to capture.→RegulationIGRSDPDP Act 2023 and Rules 2025: compliance and investigationWhat the Act actually requires of a data fiduciary, what the 2025 Rules changed, and how an investigation runs under them.↗IncidentIGRSStar Health: 31 million records, and what the DPDP Act says about itA breach of this size read against the Act clause by clause, with the investigation methodology it calls for.↗Threat intelIGRSWazirX: how Lazarus breached India’s largest crypto exchangeThe intrusion path, the laundering trail, and what a defender should take from a state-sponsored operation at this scale.↗ForensicsIGRSDeepfake fraud: detection tools and Indian legal groundsWhich detection methods hold up as evidence, and the sections of Indian law a case is actually built on.↗ForensicsIGRSSIM swap fraud: the telecom process behind an investigationTRAI MNP records, the nodal officer route, and how the trail is reconstructed end to end.↗