HEXSENTINEL
Analyste binaire et malware
Profil professionnel
HexSentinel lit le code machine comme s’il s’agissait de littérature. Fort d’une expérience de reverse engineer dans un laboratoire de défense, il compte parmi les meilleurs analystes de malwares industriels et de vers complexes.
Compétences clés
Reverse engineering avancé; analyse binaire de bas niveau; déobfuscation et unpacking; analyse du comportement des malwares ICS/SCADA; développement de signatures YARA complexes
Réalisations majeures
Désassemblage d’un malware ICS en 16 heures, en retraçant sa chaîne d’outils jusqu’à l’attaquant.; découverte du bug logique derrière un ver de supply chain affectant des dépôts NPM.
Articles de HEXSENTINEL
AI Is Changing the Ransom Note Before It Changes the Breach
A new ransomware analysis points to a quieter shift: criminals may be using AI to sharpen extortion pressure, even when the technical intrusion itself remains unclear.
Victim Post, Unverified Damage: Four Hands LLC Lands in a Ransomware Claim
Umbra is tied to a new victim listing for Four Hands LLC, but the post does not independently prove breach, theft, or operational disruption.
Ransomware Operators Test AI Tooling as a Live Intrusion Channel
A reported Gentlemen affiliate used MCP during active intrusions, raising a narrow but important warning: trusted software interfaces can become part of criminal command traffic if they are exposed or poorly contained.
Qilin Publishes CORBY ROCK MILL as a New Victim Listing
A ransomware-extortion listing tied to CORBY ROCK MILL appears online, but the public record here does not confirm a breach, data theft, or encryption.
Stolen CI/CD Secrets Put a Ransomware Affiliate on Two Tracks
A reported affiliate linked to Gentlemen ransomware is said to have paired intrusion activity with a separate leak site, widening the pressure on victims while leaving key details unverified.
Netrunner Publishes a New Victim Listing, but the Incident Picture Remains Thin
A newly posted victim entry tied to Netrunner has surfaced, but the available record does not confirm intrusion details, data theft, or impact.
Redacted Ransomware Post Leaves More Questions Than Answers
A victim listing tied to Silentransomgroup appears with the company name withheld and a "FULL DATA TIMER" active, but the underlying incident details remain unverified.
A Fresh Eclipse Victim Listing Raises Alarm, but the Evidence Stops at the Label
Ransomware.live reports a new victim post tied to Eclipse for part02.simplexengg.in, but the public record does not confirm a breach, data theft, or operational impact.
Ransomware Hits a Medical Campus, and the Data Question Starts Immediately
UIC College of Medicine was affected by ransomware, and some information was stolen from its servers, raising the usual hard question: what was taken, and who can trust the recovery?
Victim Page for Windor.com Signals Pressure, But Not the Full Story
A newly published listing tied to Settra places windor.com in a ransomware context, while the available material leaves the core incident details unresolved.
MedusaLocker Listing Raises Questions, but the Verified Trail Is Narrow
A MedusaLocker post names Rueegseggerag and mentions one extracted email, while the wider breach picture remains unconfirmed.
ENKA Schools Lands in a Doommageddon Victim Listing
A ransomware-extortion entry names the school and carries an upcoming deadline, but the available facts do not confirm a breach or stolen data.
Aurora Posts New Victim Entry for Thomas Y. Pickett & Co., Inc.
A new Aurora victim entry names Thomas Y. Pickett & Co., Inc. and lists claimed materials ranging from backups and HR files to source code and financial records.
N0n Flags Company #1 in a New Victim Entry
The listing is brief, the technical detail is thin, and the claim of an early settlement remains unverified beyond the posted label.
Deadline-Driven Extortion Marks a New N0n Victim Listing
A fresh ransomware-style listing tied to Canadian financial services shows how a public countdown can become part of the pressure campaign, even before any technical facts are confirmed.
Victim Tag Appears, But the Real Damage Question Is Still Open
Lamashtu has been linked to a newly published victim entry for Grupo Industrial Tauro, yet the available record stops short of confirming a breach narrative.
Qilin-Branded Victim Post Puts Mutsumi Group Into the Extortion Spotlight
A posted claim naming Mutsumi Group has surfaced, but the public record still ends at the announcement and does not verify a breach.
Qilin’s Latest Victim Post Turns a Name Into a Pressure Point
A newly published victim entry links Qilin to Cotesma, but the verified record remains narrow and does not confirm breach scope, data theft, or downstream impact.
Qilin's Latest Victim Tag Highlights the Limits of Early Evidence
Emser has been listed as a new victim in a Qilin-linked post, but that designation alone does not confirm a breach, data theft, or the scope of any impact.
Booba Project’s Health-System Leak Claim Raises the Alarm, Not the Proof
A ransomware-leak post names MorseLife Health System, Inc. and claims 344 GB of stolen data, but the access path and real impact remain unverified.