// CVEs
CVSS 8.4
HIGH
Remote Code Execution / Arbitrary File Read / NTLM Hash Capture as SYSTEM
- Discovered multiple privilege escalation vulnerabilities in Parsec for Windows (< 150-104a), leading to NT AUTHORITY\SYSTEM privileges. Write-up
CVSS 7.8
HIGH
Dylib injection
- Discovered a dylib injection vulnerability in JetBrains Toolbox for macOS (< 1.28), leading to TCC permissions abuse. Write-up
// Publications
Behavioral Detection Using Apple Endpoint Security Framework
Authors: Dimitrie-Toma Furdui, Radu-Marian Portase, Andrei-Marius Muntea, Adrian-Viorel Coleșa
View Abstract:
Traditional endpoint security on macOS has relied on third-party kernel extensions, which Apple is increasingly restricting. Apple's Endpoint Security (ES) framework offers a supported alternative by providing user-space access to security-relevant events, such as process execution and file activity, and by allowing or denying certain operations. This paper assesses whether ES telemetry is sufficient for building an Endpoint Detection and Response (EDR) system. We introduce a prototype user-space EDR that correlates ES events into process and process-tree activity, applies a points-based heuristic engine, and supports translating a subset of macOS Sigma rules into ES-compatible detections. Detection coverage is evaluated using Atomic Red Team. With Sigma-derived rules and custom heuristics, the prototype detects 95.13 % of the evaluated macOS Atomic Red Team tests, demonstrating that ES can enable practical behavioral detection without third-party kernel extensions.// Certifications
- Mach Injection
- Dylib Injection
- XPC Exploitation
- Sandbox Escape
- Privilege Escalation
- TCC Bypass
- ARM64 Assembly
- Reverse Engineering
- Stack-Based Buffer Overflows
- Return-Oriented Programming (ROP)
- Format String Specifier Attacks
- ASLR/DEP Bypasses
- WinDbg
- IDA Pro
- x86 Assembly
- Active Directory Exploitation
- Antivirus Evasion
- Lateral Movement
- Process Injection
- SQL Server Exploitation
- AppLocker/CLM Bypass
- Network Penetration Testing
- Web Application Exploitation
- Active Directory Exploitation
- Privilege Escalation
- Web Application Exploitation
- Active Directory Security
- Privilege Escalation
- Pivoting & Tunneling
- Network Penetration Testing
- Digital Forensics
- IDS/IPS Usage
- Incident Handling
- Malware Analysis
- SOC Operations
- Elastic Stack
- Splunk
// Achievements
Romania's National Cybersecurity Team, ECSC 2022 and 2025
Selected for the Romanian national team at ENISA's European Cybersecurity Challenge, competing in Attack/Defense and Jeopardy CTFs against 30+ other national teams.
Core Member, > r0/dev/null CTF Team
Focused on binary exploitation and reverse engineering challenges. Team results include 1st place at World Wide CTF 2025, 3rd place at N0PSctf 2025 and D-CTF 2025.
Core Organizer and Challenge Author, Null CTF 2025
Co-organized Null CTF 2025 with > r0/dev/null for 1000+ teams, authoring 7 challenges and running the infrastructure.
Core Organizer, IoT Hunt 2025
Co-organized IoT Hunt, a CTF-style treasure hunt at DefCamp 2025, where 100+ participants exploited real routers, smart cameras, lightbulbs and locks.
Captain, Technical University of Cluj-Napoca CTF Team (2023-2025)
Recruited and trained students for competitions, leading the team to 4th place at Hack The Box University CTF 2023 (300+ registered teams).
Core Organizer and Infrastructure Lead, TFC CTF (2021 & 2022)
Built a custom CTF platform from scratch with on-demand challenge instances, serving 1000+ teams, and authored 10+ challenges.
// Projects
Some projects are undergoing a major refactoring and will be publicly available on GitHub soon
MiniHV (Hypervisor (Intel VT-x))
ES-EDR-Behavior (macOS Behavioral EDR)
ES-EDR-Inject (macOS Process Injection-based EDR)
Ghost & Sorcery (Hack The Box Machine Author)
MiniOS (Operating System)
// Experience
Jun. 2021 - Present
Kernel Developer (Windows), Security Researcher @ Bitdefender
- Developing the anti-exploit module across the kernel driver and user-mode filter, shipped in Bitdefender's consumer and GravityZone products.
- Refining antivirus detection capabilities, contributing to Bitdefender's perfect 15/15 score at AV-Comparatives ATP 2025.
- Built a new ROP chain detection and improved 5+ existing privilege escalation detections against new techniques.
- Authored 30+ n-day exploit PoCs from minimal public details, including Windows DWM and Microsoft Exchange, to validate EDR detections.
C++
x86/ARM Assembly
Kernel Drivers
Malware Analysis
Oct. 2026 - Present
Teaching Assistant (Penetration Testing) @ Technical University of Cluj-Napoca
- Teaching Penetration Testing to 50+ students, addressing web exploitation, buffer overflows and privilege escalation.
- Co-authoring a penetration testing book for a full course redesign, modernizing labs and adding Active Directory and Entra ID modules.
Penetration Testing
Curriculum Design
Mar. 2026 - Present
Research Engineer @ Technical University of Cluj-Napoca
- Co-organized a CTF for 100+ students as part of the Google.org Cybersecurity Seminars initiative.
CTF Challenge Design
Oct. 2025 - Feb. 2026
Teaching Assistant (x86 Assembly) @ Babeș-Bolyai University of Cluj-Napoca
- Taught x86 Assembly fundamentals and CPU internals to 80+ undergraduate students, covering memory management, register manipulation, and instruction set architecture.
- Designed and graded 6 technical assignments requiring students to identify code issues and implement algorithms in x86 assembly.
x86 Assembly
CPU Internals
Sep. 2020 - Sep. 2022
Penetration Tester, Software Developer @ Institute of Advanced Research in Artificial Intelligence (IARAI)
- Built and maintained the organization's competition website (10,000+ participants), test infrastructure, and internal DevOps tooling.
- Introduced security reviews into the release procedures, catching 10+ issues before production deployment.
- Co-organized 4 NeurIPS competitions with 7000+ submissions (Traffic4Cast, Weather4Cast, Science4Cast, Landslide4Sense).
White-Box Security Assessments
PHP
React
Nov. 2020 - Jul. 2023
Co-founder @ Antimony (Startup)
- Co-founded a 5-person startup building an event management platform for organizers, with event discovery for participants.
- Built the iOS, Android and web apps and shipped them to the App Store and Google Play.
- Secured the platform through in-house penetration testing before launch.
White-Box Pentesting
Swift
Kotlin
Flutter
Next.js
// Education
2025 - Present
PhD in Cybersecurity (Technical University of Cluj-Napoca)
- Research topic: Hypervisor-Based Methods for Detecting Exploits
Hypervisor Development
Binary Exploitation
Malware Analysis
2023 - 2025
Master's Degree in Cybersecurity (Technical University of Cluj-Napoca)
- Thesis title: Behavioral macOS EDR Using Apple Endpoint Security Framework
Windows Driver Development
OS Development
Hypervisor Development
Malware Analysis
Forensic Analysis and Incident Response
Penetration Testing
Network Security
2020 - 2023
Bachelor's Degree in Computer Science (Babeș-Bolyai University of Cluj-Napoca)
- Thesis title: Fortifying macOS against Binary Exploits with Apple's Endpoint Security Framework
Operating Systems
Cybersecurity
x86 Assembly