HEXSENTINEL
Binary & Malware Analyst
Professional Profile
HexSentinel reads machine code as if it were literature. With a background as a reverse engineer in a defense lab, he is among the top analysts of industrial malware and complex worms.
Key Skills
Advanced reverse engineering; Low-level binary analysis; Deobfuscation and unpacking; ICS/SCADA malware behavior analysis; Complex YARA signature development
Major Achievements
Disassembled an ICS malware in 16 hours, tracing it back to the attacker's toolchain.; Discovered the logical bug behind a supply-chain worm affecting NPM repositories.
Articles by HEXSENTINEL
School Named in Extortion Listing as Ransomware Pressure Builds Around a Thin Evidence Trail
Westrop Primary & Nursery School appears in a ransomware-and-extortion listing tied to Thegentlemen, but the published material stops short of proving a breach or data theft.
Fresh Victim Tagging Puts Industrial Supplier in Ransomware Spotlight
A listing tied to Thegentlemen names WOOSHIN SAFETY SYSTEMS CO LTD, but the public record is still too thin to confirm any technical intrusion or downstream harm.
Storm’s Name on a Factory Target Creates Noise Before Proof
A victim listing tied to Allied Machine & Engineering may signal an extortion claim, but the available details do not confirm intrusion, theft, or scope.
Extortion Post Turns Aware Into a New Pressure Target
A victim listing tied to Thegentlemen claims 400 GB of data, but the allegation remains unverified and should be treated as an extortion signal, not proof of breach.
COAL Leak Claim Puts a Spanish Professional Body in the Spotlight
A new alleged victim page tied to Akira names the Official College of Architects of León and claims a sizable data set, but the exposure remains unverified.
Nightspire Listing Puts Pharma Research Data in the Crosshairs Again
A new victim entry tied to Forma Therapeutics Holdings, Inc. underscores how ransomware operators can weaponize sensitive research records even when the full incident picture is still unclear.
Warlock’s SharePoint Trail Raises the Stakes for Critical Services
A ransomware name tied to critical infrastructure incidents now sits alongside reported Microsoft SharePoint exploitation, but the full intrusion chain and impact remain unconfirmed.
Akira’s Latest Victim Listing Puts Sensitive Records in the Crosshairs
A claimed 77 GB upload tied to COAL remains unverified, but the allegation shows how extortion crews try to turn private records into leverage.
Wallstreet Names Tronex A/S in a Fresh Claimed Victim Post
A new claimed victim in the manufacturing supply chain highlights how even a limited disruption can be costly for industrial firms.
University Name Lands in a Ransomware Listing, but the Data Claim Still Needs Proof
A victim post tied to the Booba Project names the University of Illinois Chicago and alleges 344 GB of stolen data, yet the technical picture remains unverified.
Victim Listing Puts Medical Center in the Crosshairs, but the Data Claim Stays Unproven
A Booba project victim post naming Soni Medical Centre and a claimed 5.5 GB haul may intensify pressure, yet the underlying compromise remains unverified.
Booba Project Lists EdgeEndo USA, Claims 103 GB of Medical Device Data
A new victim entry tied to a ransomware and extortion label alleges a sizeable data theft, but the claim remains unverified.
Ransomware Listing Puts a Treatment Provider Under the Microscope, but Proof Is Thin
A victim post tied to Incransom names Rimrock Foundation, yet the available record does not confirm intrusion, data theft, or patient impact.
Warlock Ransomware Pressures Iberian Targets as Attribution Noise Lingers
Large organizations in Spain and Portugal are reported under ransomware pressure, while a separate Chinese-threat-actor label remains unverified and should be treated cautiously.
Akira’s New Leak Claim Turns Wesmar Into a Data-Pressure Target
A reported 66 GB dump, if accurate, would raise the stakes from simple extortion to a potentially sensitive data exposure case.
Deadlock Listing Pulls a High-Security Builder Into the Ransomware Spotlight
Far West Contractors has been named as a new victim, but the available record does not confirm the full intrusion path, data impact, or whether any downstream systems were affected.
Deadlock Listing Casts a Fresh Shadow Over a Financial Services Firm
Union FA has been named in a ransomware victim listing, but the available facts do not confirm a breach scope, data theft, or root cause.
Settra Brings mcpolymers.com Into the Spotlight, But Proof Still Matters More Than the Post
A new victim entry tied to mcpolymers.com has appeared under the Settra name, yet the available record does not confirm a breach, data theft, or real-world disruption.
Settra Posts Baltimore Freightliner as a New Victim
A ransomware listing has linked Baltimore Freightliner to Harbor Truck Sales and Service, Inc., but the visible entry does not confirm a breach, stolen data, or the full scope of any impact.
Warlock’s SharePoint Push Exposes a Thin Edge in Critical Infrastructure
Exploitation of a widely used collaboration platform can become a serious security problem even when the full breach picture is still unclear.