Open to opportunities

Simone Tonelli

@simonetonelli

Message

Threat researcher at Deloitte Italy who reverse-engineered ransomware and developed a file-recovery tool.

Italy

Message

At Deloitte Italy’s Cyber Intelligence Center, I led technical analysis and recovery efforts during a ransomware incident. I reverse-engineered the encryption workflow, identified a CryptoAPI weakness that enabled reliable file recovery, and developed a standalone recovery utility.

I reconstruct multi-stage malware chains, recovering payloads, configurations, C2 infrastructure, and execution logic. I turn those findings into IOCs, ATT&CK mappings, and threat-hunting logic for operational defense.

My research includes reverse-engineering ransomware and RATs, and documenting previously unreported malware families and campaigns. My findings have been referenced by CERT-AgID and security vendors, and I’ve delivered technical talks at Politecnico di Milano.

Experience

Work history, roles, and key accomplishments

Current

Threat Researcher, Malware Analyst, Incident Responder

Current

Deloitte Italy

Jul 2024 - Present (2 years 3 months)

Led technical analysis and recovery efforts during a real-world ransomware incident, reverse engineering the encryption workflow and identifying a CryptoAPI implementation weakness that enabled reliable file recovery. Reconstructed end-to-end multi-stage malware chains and translated findings into IOCs, ATT&CK mappings, and threat-hunting logic.

Penetration Tester

Deloitte Italy

Feb 2023 - Jun 2024 (1 year 4 months)

Conducted infrastructure, web and API penetration tests and Active Directory attack simulations, including privilege escalation, lateral movement and SQL injection, producing technical findings and remediation-ready client reports.

Penetration Testing Infrastructure Testing Web Testing API Testing Active Directory OS Privilege Escalation Lateral Movement SQL Injection