HEXSENTINEL
Binary & Malware Analyst
Professional Profile
HexSentinel reads machine code as if it were literature. With a background as a reverse engineer in a defense lab, he is among the top analysts of industrial malware and complex worms.
Key Skills
Advanced reverse engineering; Low-level binary analysis; Deobfuscation and unpacking; ICS/SCADA malware behavior analysis; Complex YARA signature development
Major Achievements
Disassembled an ICS malware in 16 hours, tracing it back to the attacker's toolchain.; Discovered the logical bug behind a supply-chain worm affecting NPM repositories.
Articles by HEXSENTINEL
Fresh Victim Listing Puts a Florida Contractor in the Ransomware Spotlight
A new extortion post names Downrite Engineering, but the public record still stops short of proving breach scope, data theft, or encryption.
Extortion Listing Puts Cedars Foods on the Radar, But the Damage Picture Is Still Unclear
Cedars Foods has been named in a ransomware and extortion victim listing tied to Thegentlemen, but the available material does not confirm breach scope, data theft, or operational disruption.
New Victim Listing Puts Gelarti in the Crosshairs, But the Damage Is Still Unproven
A ransomware-affiliated claim has surfaced around Gelarti, yet the public record still does not confirm how far any intrusion went or whether data was taken.
Victim Name Appears on a Leak Page, but the Breach Story Is Still Unproven
A ransomware-linked victim listing names a Gothenburg-area technical school, yet the public record still stops short of confirming intrusion, exfiltration, or downstream impact.
Victim Listing Alone Is Not Proof, But It Still Raises the Stakes
A ransomware-era posting names ACA Pescara, a public housing body in Italy, but the available evidence stops short of confirming breach, theft, or disruption.
LockBit5 Listing Draws Attention to a Finnish Accounting Firm, But Verification Still Matters
A published victim listing tied to httoy.fi and Tilitoimisto HTT Oy underscores that public ransomware claims can create pressure before facts are verified.
LockBit5 Victim Post Surfaces, But the Evidence Stops at the Label
A newly published victim listing tied to LockBit5 and tpi.tw raises attention, yet it does not by itself confirm breach, theft, or impact.
Ransomware Claim Lands on a French Wholesaler, but the Technical Picture Remains Unproven
Eclipse has listed Rosello et Fils as a victim, yet the available details stop short of confirming breach scope, encryption, or data theft.
Leak-Claim Pressure Lands on a Law Firm Name
A victim listing tied to the Booba project puts Mestechkin Law Group P.C. in an extortion narrative, but the data claim and any breach details remain unverified in the provided record.
Ransom Listing Turns Steelhaus Domain Into a Public Pressure Point
A victim entry tied to Chaos is a warning sign, not proof of breach, but it can still raise the stakes for any team that must now verify what is real.
Auditteam Posts a New Victim Listing for Ne***ox
A fresh ransomware-and-extortion entry names a redacted target, but the public record stops short of proving what was taken, if anything, or how far the incident reached.
Leak-Site Claim Puts Kashkha Under a Ransomware Lens
A published victim listing tied to Krybit is enough to trigger concern, but it does not by itself confirm a breach, data theft, or the full scope of any incident.
Extortion Claim Puts Commercial Records Under Pressure
A reported ransomware-style post tied to Emperador names Navitrans and references 223.2 MB of material, with alleged exposure of pricing and financing records.
Deadline Threats, Not Proof: ShinyHunters Pushes a New Pressure Campaign
A public extortion-style post names Kimberly-Clark and sets a leak deadline, but the breach claim itself remains unverified.
Vexy’s Latest Victim Listing Raises Pressure on a High-Trust Service Provider
A ransomware victim notice tied to Strad Solutions matters not only for the naming event itself, but because service providers can sit close to customer systems, credentials, and recovery paths.
Victim Listing Lands Watchops.com in a Ransomware Spotlight
A reported extortion-style listing names watchops.com and attaches an unverified revenue figure, but the public record does not establish a breach, data theft, or root cause.
Krybit Publishes a New Victim Listing for SCIPL
A public entry names Swadeshi Civil Infrastructure Private Limited, but the listing does not independently confirm breach, data loss, or operational disruption.
Victim Listing First, Proof Later: The Meridian 16 Signal That Defenders Should Not Ignore
A Krybit-linked victim entry for meridian16.hr is a credible warning sign, but the underlying incident details remain unverified.
Leak-Board Victim Tag Leaves Questions, Not Proof
A new victim entry tied to Krybit puts intherpro.com in the ransomware frame, but the available record does not verify breach scope, data theft, or operational impact.
Public Victim Label Puts a French Drama School Domain Under Ransomware Pressure
Krybit is tied to a new victim listing for eracm.fr, but the available material does not confirm a breach, data theft, or operational impact.