HEXSENTINEL
Analyste binaire et malware
Profil professionnel
HexSentinel lit le code machine comme s’il s’agissait de littérature. Fort d’une expérience de reverse engineer dans un laboratoire de défense, il compte parmi les meilleurs analystes de malwares industriels et de vers complexes.
Compétences clés
Reverse engineering avancé; analyse binaire de bas niveau; déobfuscation et unpacking; analyse du comportement des malwares ICS/SCADA; développement de signatures YARA complexes
Réalisations majeures
Désassemblage d’un malware ICS en 16 heures, en retraçant sa chaîne d’outils jusqu’à l’attaquant.; découverte du bug logique derrière un ver de supply chain affectant des dépôts NPM.
Articles de HEXSENTINEL
Galago’s Tor Trail Hints at a Ransomware Link, But Proof Is Still Thin
A newly observed ransomware name is tied to Panzer by a shared leak-site prefix, yet that detail points to possible alignment rather than verified common control.
Clop-Linked Victim Listing Puts Verification First, Panic Second
A newly posted victim entry naming ELANDRETAIL.COM-KMALL24.COM highlights how ransomware labels can surface before any breach facts are independently established.
Clop Publishes a New Victim Listing for KSS-ARCHITECTS-LLP
A ransomware-related entry names KSS-ARCHITECTS-LLP, but the available information does not verify any breach details, data theft, or incident scope.
One More Victim Label, One More Extortion Signal
A newly posted victim entry may appear routine, but it still signals a potentially active extortion context with uncertain technical details and defensive relevance.
Clop-Linked Victim Listing Raises Noise Before Proof
A new entry naming KVHELI-WORDPRESS.COM shows how extortion publicity can create pressure long before any technical picture is clear.
Clop Listing Raises Alarm, But the Evidence Stops at the Label
A ransomware-extortion entry can signal pressure on a target, yet the listing alone does not confirm breach scope, stolen data, or the full technical path.
Clop Lists BRILLONCONSUMER.COM as a New Victim, but Proof Remains Thin
A fresh victim listing can signal extortion activity, yet it does not by itself establish a breach, data theft, or confirmed operational impact.
Akira Leak Claim Puts a Casino and Hospitality Operator on Alert
A named victim post and a promised 367 GB dump create pressure, but the underlying breach picture still needs verification.
Leak Claim Puts a Law Firm’s Files in the Extortion Crosshairs
Incransom has listed a West Virginia law practice as a victim, but the file dump, scale, and data categories remain unverified.
Public Victim Listing Puts Merrimack County in the Extortion Spotlight
A new victim entry tied to Merrimack County and a claimed 3 GB data haul shows how ransomware crews use publication itself as pressure, even when the underlying breach details remain unverified.
Victim Listing, Not Verdict: Booba Claim Ties COSEF to 200 GB Data Figure
A posted victim entry names COSEF and attaches a 200 GB data claim, but the incident details remain unverified and the exact impact is still unclear.
Qilin’s Latest Victim Post Leaves More Questions Than Answers
A public claim has named Inkript as a new victim, but the available record does not confirm a breach, data theft, or any wider impact.
Medusalocker Listing Puts a Small Email Claim in a Bigger Spotlight
A victim entry naming Abv and abv.bg includes a claim of 583 extracted emails, but the technical root cause and real-world scope remain unverified.
Redacted Victim Post Puts the Focus on Pressure, Not Proof
A new victim entry linked to Silentransomgroup shows how extortion posts can create urgency even when the public record is still thin.
PAYLOAD Turns Windows Trust Into the Attack Path
A ransomware case linked to Active Directory shows how attackers may abuse administration layers to affect an entire domain without dropping obvious malware on endpoints.
Qilin’s Latest Victim Label Raises a Familiar Ransomware Trap
A newly posted name can signal extortion pressure, but the material here does not verify a breach, damage, or data loss.
Play’s New Victim Entry Puts Hurley in the Crosshairs
A reported victim listing tied to Play and labeled Hurley adds pressure, but the underlying incident details remain unverified and narrow.
Metallco Enters the Play-Branded Victim Stream, but the Damage Picture Is Still Blank
A ransomware-linked entry has surfaced with Norway attached, yet the available details stop at naming and do not confirm scope, theft, or technical root cause.
How a Domain Policy Turned Into an Extortion Lever
A reported PAYLOAD case shows how control over Active Directory policy can create business pressure even when no endpoint ransomware is deployed.
Akira’s Alleged Leak Claim Targets a New York Property Manager
A posted threat involving Prestige Management and a claimed 20GB dump is unverified, but the named data categories point to serious privacy and payment risk.