Matt Suiche

Background

Matthieu "Matt" Suiche is a French computer security researcher and entrepreneur, born September 22, 1988, near Paris. According to CyberScoop, he dropped out of formal schooling around 2007 to focus on programming and software development, and began presenting at international security conferences while still a teenager, with an early focus on vulnerabilities in Microsoft products. He held internships at Airbus and a research position with the Netherlands Forensic Institute before moving fully into commercial security work.

MoonSols and early memory forensics research

Suiche built his early reputation on memory forensics, a discipline focused on extracting and analyzing evidence from a computer's volatile (RAM) memory rather than its disk. He reverse-engineered the Windows hibernation file format and its LZXPRESS compression scheme, and conducted physical memory analysis research on Mac OS X, which he presented at Black Hat DC in 2010. He founded MoonSols, a firm specializing in memory forensics and incident response tools, and later developed LiveCloudKd, a utility for analyzing running Microsoft Hyper-V virtual machines; Microsoft Technical Fellow Mark Russinovich has said the work impressed Microsoft enough to invite Suiche to speak at the company's internal BlueHat Security Briefings. Suiche was recognized as a Microsoft Most Valuable Professional from 2009 to 2015 and was named one of France's 100 key developers in 2014. He also co-founded the Hackito Ergo Sum security conference in Paris.

CloudVolumes and Comae Technologies

In 2011 Suiche co-founded CloudVolumes (originally SnapVolumes), an application-virtualization company, which was acquired by VMware in 2014. In 2016 he founded Comae Technologies, a UAE-based cybersecurity company specializing in cloud-based memory analysis used to recover forensic evidence from the volatile memory of compromised devices. Comae's technology and intellectual property were acquired by Magnet Forensics in May 2022, after which Suiche joined Magnet Forensics as director of memory and incident response R&D, leading a team integrating memory-analysis technology into the company's existing forensics platform.

Analysis of The Shadow Brokers

Suiche became widely known in 2016 and 2017 for his public technical analysis of The Shadow Brokers, the still-unidentified individual or group that leaked a cache of NSA-linked hacking tools, including exploits such as EternalBlue and the DOUBLEPULSAR implant. In blog posts published on Medium under the Comae Technologies account, including "Shadow Brokers: The insider theory" and "Is Harold Martin behind Shadow Brokers?" (both dated August 2016), Suiche argued that the pattern of the leaks was more consistent with an insider — such as a disgruntled current or former intelligence-community contractor physically removing files — than with a purely remote, external compromise of NSA systems. His insider theory preceded, by roughly two weeks, the public criminal complaint against former NSA contractor Harold T. Martin III, a coincidence widely noted in subsequent press coverage. Suiche continued his analysis at Black Hat USA 2017 with a talk titled "The Shadow Brokers: Cyber Fear Game Changers." The Shadow Brokers themselves referenced Suiche directly and cryptically in several of their public messages, at times addressing him by name.

Significance and legacy

Suiche's work sits at the intersection of applied memory-forensics research and public-facing threat intelligence. His technical contributions helped popularize memory analysis as a standard incident-response technique, an area later commercialized through MoonSols and Comae and eventually folded into a larger forensics vendor's product line via the Magnet Forensics acquisition. His Shadow Brokers commentary, meanwhile, made him one of the more visible independent analysts tracking one of the most consequential and still-unresolved leak incidents in the history of NSA-linked cyber tools, work covered by outlets including CyberScoop, Wired, and The New York Times. He has continued to comment publicly on nation-state cyber capabilities and, more recently, founded OnDB Inc., a data-infrastructure startup.

Timeline

• 1988-09-22Born near Paris, France.
• 2007Leaves formal schooling to focus on programming and begins presenting at international security conferences as a teenager.
• 2010Presents physical memory analysis research on Mac OS X at Black Hat DC.
• 2011Co-founds CloudVolumes (originally SnapVolumes), an application-virtualization company.
• 2014CloudVolumes is acquired by VMware.
• 2016-08Publishes 'Shadow Brokers: The insider theory' and 'Is Harold Martin behind Shadow Brokers?' on Medium, arguing the NSA-linked leaks likely originated from an insider.
• 2016Founds Comae Technologies, a UAE-based memory analysis and incident response company.
• 2017Presents 'The Shadow Brokers: Cyber Fear Game Changers' at Black Hat USA.
• 2022-05-06Comae Technologies' intellectual property is acquired by Magnet Forensics; Suiche joins as director of memory and incident response R&D.