Orion Wallace
Hunts & Builds
Nine years hunting nation-state actors across DoD cyber operations.
I reverse malware, orchestrate red teams, lead Cyber Threat Intelligence Teams in the OT/IT space, and turn raw threat data into intelligence that shapes national-security posture.
Full-stack systems,
built to last.
I'm Orion Wallace. Principal Cyber Threat Intelligence Analyst for the DoD and founder of CINDR Security Research. Active TS/SCI clearance, nine years across DoD cyber operations and defense-industrial software development.
I hunt APTs, lead red team operations, and reverse malware — with deep work against Chinese state-sponsored actors and Russian-nexus campaigns. Previously Senior Software Engineer at Northrop Grumman shipping secure C++ for embedded systems.
Things I've shipped.
CINDR Intelligence Suite
Modular CTI tooling that compresses the malware-triage-to-attribution-to-detection workflow from hours to minutes. Cloud-native triage engine returns structured static + behavioral analysis across 25+ file types in under 5 minutes; TTP Mapper ranks probable APT attribution via weighted F1 scoring against the full MITRE ATT&CK dataset.
ConnToProc
Windows Native API tool that watches new host connections, traces them back to the originating process, and emits custom events into an ELK stack for downstream threat hunting.
CVEScout
Cyber Threat Intelligence tool that generates a CVE Crosswalk and per-actor risk assessments for a given network surface. Delivered to 67th Cyberspace Wing and distributed to 15 Cyber Operations Squadrons.
InfrastructureScan
OSINT Purple Team software that uses publicly available infrastructure data or IoCs to programmatically discover and map networks. Designed to uncover Malicious Cyber Actor infrastructure; adopted by Red/Blue Teams.
What I'm on this month.
Lead reverse engineer on the Zera Info-Stealer malware campaign at CINDR Security Research — multi-stage Electron payload, Russian-nexus attribution.
CINDR Intelligence Suite — modular cloud-native CTI tooling for DFIR teams and SOCs. Three tools in active development: IOC Enrichment Hub, Threat Report Extractor, Detection Rule Builder.
Principal Cyber Threat Intelligence Analyst, USAF Reserve. SME on Chinese state-sponsored cyber actors.
Building an AI-enabled reverse engineering system — automating malware triage, deobfuscation, and TTP extraction to accelerate analyst workflows.