We are a cybersecurity research group in the Department of Computer Science at The University of New Mexico, led by Afsah Anwar. We uncover and defend against emerging threats to VPNs, satellites, mobile apps, and web applications through malware analysis, vulnerability research, and threat intelligence.
Our research has delivered measurable real-world impact. Our study of SMS-delivered URLs uncovered personal-data exposure across 177 online services, leading 7 providers to fix the vulnerabilities and being covered by Ars Technica, Help Net Security, and TechRadar Pro. Our MVPNalyzer framework analyzed free Android VPN apps, exposing widespread data leaks and security failures, with coverage from The Hacker News and Michigan Engineering News. We have also discovered a novel spacecrafts vulnerability.
Our research has caught the attention of global cybersecurity authorities. We have been spotlighted by Azerbaijani CERT, UK National Cyber Security Centre (NCSC), and NASA IV&V.
Research Areas
Join the Lab
We are looking for passionate PhD students and a postdoc to work on real-world security problems.
Sponsors
News
September 2026Our paper on “Exposing Probe-Resistant VPN via Protocol Coexistence” has been accepted at IEEE S&P 2027. Congratulations Enrique, Danish, and Jack!
August 2026Our work on SMS-delivered URLs was covered by Azerbaijani CERT, Computer Emergency Response Center. Read here.
August 2026Our work on SMS-delivered URLs was included in the CTO of the UK’s National Cyber Security Centre’s weekly newsletter. Read here.
August 2026We are happy to welcome Natalie and Sijan! They will be working on various research projects in security and privacy. Welcome to the team!
July 2026Paper on "The Tragedy of Convenience: Cascading User-Data Leakage from SMS-delivered URLs" will appear at ACM CCS 2026. Congrats Danish and Enrique! Read the Preprint
June 2026Danish received a Bug Bounty worth $1,000 for his work on SMS-delivered URLs. Congratulations Danish!
April 2026We have received NSF CAREER award on building resilient VPNs. Thank you to the students, collaborators, and NSF for their support!
April 2026We hosted Kendra Cook from NASA IV&V. She discussed about “Trust, but Verify (Independently):Securing NASA’s Mission-Critical Software”. Thank you Kendra for visiting us!
March 2026We were visited by David Huggins and Ron Prado from Georgia Tech Research Institute. Thank you for visiting us!
See all news →