Networks

If you teach, design and develop networks for several years, you master a lot of protocols and technologies. However, we are not a bunch of academics disconnected from the reality! We can solve real-life problems of our customers by having an objective view and applying reasonable thinking. We are ready for your mission-specific networking troubles.

Forensics

Have you ever wonder how to find a needle in a haystack? We do! That is the reason why we focus on networking forensics. If you want to find meaningful information in terabytes of captured data or if you are struggling with your cryptocurrency related investigation, we can help you. We gathered a lot of experience from our cooperation with government institutions.

Research

We have a strong academic background! Our products originated from our cooperation with research institutions. We were participating in various research grants and projects focused on cybersecurity and privacy. We support a collaboration, thus, we try to publish our results at global conferences.

Consulting

Our consulting services provide experts guidance on cybersecurity, digital forensics, cybercrime investigations, threat intelligence, and operational readiness. These services includes also development of expert opinions for courts.

Training

We love to share our knowledge and know-how with others! Furthermore, teaching is our daily bread at the university. We customize training according to the specific needs and request of our clients. We are proud of our certification portfolio (including industry-recognized exams by Cisco, Microsoft, Red Hat, Juniper, Google).

COINØMON

COINØMON is a comprehensive cryptocurrency analytics tool designed for law enforcement agencies and fintech/regtech companies to perform blockchain forensics and monitor cryptocurrency networks. The platform provides blockchain visibility and wallet clustering, as well as specialized network intelligence, such as IP geolocation and peer activity, to help users “follow the value” of assets. To ensure maximum data confidentiality and seamless integration with other analytical tools, COINØMON utilizes an on-premises deployment model by default that also supports API access, enabling COINØMON to act as a data source for third-party applications. From OSINT-based identity attribution to generating localized evidence exports with chain-of-custody management, COINØMON is built to transform raw blockchain and network data into actionable intelligence.

WI:INTR

WI:INTR is a compact, low-power tactical hardware system designed to help law enforcement agencies conduct wireless reconnaissance and monitoring activities. The device is equipped with Wi-Fi, Bluetooth, GPS, and LTE and is designed for discreet deployment near a target. This allows operators to manage it remotely from anywhere in the world via secure IP tunnels. WI:INTR’s primary capabilities include scanning for surrounding devices and leveraging wireless technology to obtain various types of evidence. WI:INTR combines active probing and passive analysis to enable operators to determine human presence and access networks. Additionally, WI:INTR can be used as a GPS tracking platform, allowing you to effectively monitor large-scale operations via an intuitive graphical interface.

ENNΞRACT / PA$⁠$⁠VORTO

ENNΞRACT is a powerful distributed password-recovery platform designed for law enforcement agencies to efficiently restore passwords for a wide array of applications and files. Operating as a centralized controller that manages Hashcat across multiple nodes, the system achieves superior scalability and performance by distributing workloads at the individual GPU card level rather than the machine level. Built on a stable NixOS Linux foundation, ENNΞRACT features an adaptive scheduler for dynamic resource management, a REST API for infrastructure integration, and a unified interface for orchestrating complex attacks. To overcome the limitations of traditional brute-force methods, the platform is often paired with high-performance hardware like Tansy and the PA$$VORTO tool, which optimizes recovery efforts by generating custom dictionaries from curated data sets.

TΛNSY

TΛNSY is a specialized password recovery and high-performance computing (HPC) platform designed for 24/7 computational intensity. Manufactured in the Czech Republic, the system features a 4U rack chassis capable of housing between 8 and 12 GPUs, supported by industry-leading cooling fans and power supply units delivering up to 9,000 Watts of combined energy. A key advantage of TΛNSY is its vendor-agnostic architecture, which allows for extensive component customization and seamless compatibility with a variety of software solutions, including ENNΞRACT, Hashcat, John the Ripper, Hashtopolis and FITcrack. By focusing on specialized hardware design rather than general-purpose computing, TΛNSY provides a high-performance, cost-effective alternative to traditional industry HPC solutions that can be nowadays also effectively leveraged for AI-driven tasks.

STARK – Strategic, tactical, criminal analysis of forensic methods for tracing in cryptocurrency networks

Project call: OPSEC: Open Challenges in Security Research 2023-2029
Project duration: from January 2023 to December 2025

Project Overview

Cryptocurrencies enable near-instantaneous transfers of assets (or more generally smart contracts) through a decentralized network of peers (who may not trust each other at all). Bitcoin, Ethereum and other cryptocurrency networks, by their characteristics (such as pseudonymity), pose a real challenge (for law enforcement) when used as means of payment associated with criminal activity.

The area investigated by the project is the evaluation of forensic methods for tracing users and their activities in cryptocurrency networks. The solution will include the implementation of ad hoc tools for the collection of data and metadata, which would be subsequently mined primarily by security forces in the performance of activities related to the detection of crimes, illegal activities and security incidents using cryptocurrencies.

The main output of the project will be the analysis, implementation, and subsequent evaluation of methods for monitoring events in selected cryptocurrency networks. The methods will produce data that will be used to:

detecting peers and their activities;
geolocation of transactions;
uncovering obfuscation techniques;
correlation with activities on overlay networks.

The target group of the project is primarily intended for the security forces of the Czech Republic and law enforcement agencies across the Europe.

Project Objectives

The essence of the submitted project and its methodological proposal is:

extend the existing know-how (to delve into the specifics of network and blockchain analysis of other cryptocurrencies such as Ethereum, Litecoin, Ethereum Classic or Bitcoin Cash);
improve and refine existing methods (by scaling the monitoring infrastructure);
collect and analyse more data (both on and off blockchains, e.g. on dark marketplaces);
combine all the above activities and possibly extract completely new insights from them (e.g. de-obfuscation using a blender, correlation of purchases on the dark web, value conversion between blockchains).

Considering the specifics of the primary users, the project foresees classified results of the sensitive parts (report and database) in order not to compromise their application in security practice. However, in line with the support of the research and innovation sphere through open access resources, workshops and a journal publication evaluating non-sensitive information from the monitoring of cryptocurrency networks will be produced as partial outputs in cooperation with the Brno University of Technology.

STARK – Strategic, tactical, criminal analysis of forensic methods for tracing in cryptocurrency networks

Project call: OPSEC: Open Challenges in Security Research 2023-2029
Project duration: from January 2023 to December 2025

Project Overview

detecting peers and their activities;
geolocation of transactions;
uncovering obfuscation techniques;
correlation with activities on overlay networks.

The target group of the project is primarily intended for the security forces of the Czech Republic and law enforcement agencies across the Europe.

Project Objectives

The essence of the submitted project and its methodological proposal is:

extend the existing know-how (to delve into the specifics of network and blockchain analysis of other cryptocurrencies such as Ethereum, Litecoin, Ethereum Classic or Bitcoin Cash);
improve and refine existing methods (by scaling the monitoring infrastructure);
collect and analyse more data (both on and off blockchains, e.g. on dark marketplaces);
combine all the above activities and possibly extract completely new insights from them (e.g. de-obfuscation using a blender, correlation of purchases on the dark web, value conversion between blockchains).

Deliverables

Deadline	Code/Type	Description of the expected result
12/2023	S – specialized database	Aggregated peer metadata and geolocated transactions for year 2023.
12/2024	S – specialized database	Aggregated peer metadata and geolocated transactions for year 2024.
12/2025	S – specialized database	Aggregated peer metadata and geolocated transactions for year 2025.
12/2025	V – research report	The main output of the project will be a restricted research report describing: * specifics of peer metadata collection and transaction geolocation for selected cryptocurrencies * tools and modules implementing information collection and correlation * database schema + collected data and metadata * recommended practices for forensic analysis of the blockchain or operation of the cryptocurrencies studied by the project

Supported by

This project Strategic, tactical, criminal analysis of forensic methods for tracing in cryptocurrency networks (codename STARK, identifier VK01010231) is supported by the Czech Ministry of the Interior’s programme Open Challenges in Security Research 2023-2029 (OPSEC).