HEXSENTINEL
Binary & Malware Analyst
Professional Profile
HexSentinel reads machine code as if it were literature. With a background as a reverse engineer in a defense lab, he is among the top analysts of industrial malware and complex worms.
Key Skills
Advanced reverse engineering; Low-level binary analysis; Deobfuscation and unpacking; ICS/SCADA malware behavior analysis; Complex YARA signature development
Major Achievements
Disassembled an ICS malware in 16 hours, tracing it back to the attacker's toolchain.; Discovered the logical bug behind a supply-chain worm affecting NPM repositories.
Articles by HEXSENTINEL
Clop Claim Tied to HENRYPRATT.COM Leaves More Questions Than Proof
A ransomware claim linked to HENRYPRATT.COM is identified by an attack hash, but the available details stop well short of confirming breach, scope, or impact.
A New Victim Listing Puts Mesan USA in the Extortion Spotlight
A ransomware-style listing tied to Global Secret Group names Mesan USA and attaches file counts, but the real technical impact remains unverified.
Dark Project’s Specchem Claim Puts a Large File Haul Under a Legal Microscope
A victim listing tied to Specchem LLC points to an alleged ransomware-and-extortion event, but the technical path and full impact remain unconfirmed.
Vexy Victim Listing Puts Logar Network Solutions in the Spotlight
A reported Vexy ransomware victim entry names Logar Network Solutions, but the available information does not establish compromise, data theft, or downstream impact.
Storm Lists Melitron as a New Victim Entry
A ransomware listing names the Canadian manufacturer, but the available record does not confirm a breach, data theft, or any operational disruption.
Storm Listing Puts Flexmaster in the Crosshairs, but the Breach Story Is Still Unproven
A ransomware-board entry names Flexmaster as a new victim, yet the publicly visible details stop well short of confirming intrusion, theft, or operational damage.
Storm Claim Leaves Technology-Dynamics in the Ransomware Fog
A named extortion crew has linked itself to Technology-Dynamics, but the available record stops short of proving a breach, stolen data, or operational impact.
Unverified Leak Post Puts BAYMER in Extortion Spotlight
A reported victim listing tied to Emperador mentions “important documents” and a 1.4 GB size, but the underlying breach claim remains unconfirmed.
Anubis Claim Leaves Gellibrand-Support-Services in a Narrow but Telling Spotlight
A ransomware post names Gellibrand-Support-Services and attaches a hash, but it does not independently establish a breach, impact, or technical cause.
One Claimed Ransomware Hit, One Website Marker, and a Lot Still Unknown
Eclipse is named in a ransomware claim tied to TTG-Asia-Media, but the public record here remains limited to an allegation, a hash code, and a listed target website.
Lockbit5’s New Victim Post Raises Alarm, Not Proof
A fresh victim listing for contreras.com.ar has appeared, but the public record still leaves the underlying incident unconfirmed.
Victim Listing Alone Does Not Prove Breach in Qilin Case
Qilin has been linked to a new victim entry naming Alaska Electrical Apprenticeship, but the available details stop at the listing and do not confirm intrusion, theft, or scope.
Leak Page, Big Signal: Eclipse’s Claim Puts TTG Asia Media Under the Spotlight
An extortion-style victim listing has placed TTG Asia Media in Eclipse’s crosshairs, but the public record still does not prove a breach, theft, or operational impact.
Akira Leak Page Puts CreateASoft Under Extortion Pressure
A victim entry tied to CreateASoft has appeared on a ransomware leak page, but the claim of data upload remains unverified.
Privilege, Silence, and Spread: A Ransomware Run Through Windows Trust
A documented intrusion inside a Windows network shows how a created domain admin account, disabled security tools, and Active Directory abuse can turn internal trust into a ransomware path.
Thin Ransomware Claim, Heavy Consequences for Verification
A named group, a hash, and an undisclosed target are enough to raise alarms, but not enough to prove an intrusion.
Panzer’s RaaS Pitch Raises the Risk for Hybrid Estates
A newly tracked ransomware brand is advertising broad platform coverage, and that combination is a warning sign for defenders running mixed Windows, Linux, and virtualized environments.
Qilin Claim Names Partners-Group-SK, but Proof Remains Thin
A ransomware post attaches a hash to the claim and leaves the victim website as N/D, making verification the real story rather than the allegation itself.
When a Victim List Becomes a Pressure Tool, the Damage Often Starts Before Verification
A ransomware-extortion listing tied to MEI Architects shows how one unverified victim post can still create real risk when personal records and project files are bundled together.
Leak-Site Flag on Everest and GGS Leaves More Questions Than Answers
A new victim listing tied to Everest and GGS is a reminder that ransom postings can signal risk without confirming the full intrusion story.