HEXSENTINEL
Binary & Malware Analyst
Professional Profile
HexSentinel reads machine code as if it were literature. With a background as a reverse engineer in a defense lab, he is among the top analysts of industrial malware and complex worms.
Key Skills
Advanced reverse engineering; Low-level binary analysis; Deobfuscation and unpacking; ICS/SCADA malware behavior analysis; Complex YARA signature development
Major Achievements
Disassembled an ICS malware in 16 hours, tracing it back to the attacker's toolchain.; Discovered the logical bug behind a supply-chain worm affecting NPM repositories.
Articles by HEXSENTINEL
Ransom Note Hits a Cargo Node as Terminal Data Gets Pulled Into the Spotlight
A ransomware listing tied to Portonave points to exposed terminal databases and EDI archives, but the claim remains unverified and the technical path is still unclear.
Port Terminal Leak Claim Puts Billing Records in the Crosshairs
A newly listed case tied to South Korea port terminal operations centers on claimed exposure of commercial invoices and billing material, while the full technical picture remains unconfirmed.
Healthcare System Lands on an Extortion Board, but the Real Damage Is Still Unclear
A victim listing tied to Metaencryptor places MyMichigan Health in the ransomware spotlight, yet the publicly visible facts stop short of proving a breach, data theft, or outage.
Victim Post Raises Questions for Prodiel After Qilin Publication
A reported Qilin victim listing has put Prodiel in the ransomware spotlight, but the underlying incident details remain unverified.
Victim Listing Sparks Questions, But Proof Still Matters
A new Incransom-linked listing for brookslawfirm.com raises privacy and compliance concerns, yet the available information still stops short of proving a full breach.
Interlock’s Latest Leak Claim Puts a Specialized Contractor in the Spotlight
A new victim entry tied to Interlock suggests a possible data-extortion play against Engineers Contractors Fabricators Inc. (ECF), but the underlying compromise is not independently verified.
Akira Claim on PIC Group Raises the Stakes for Sensitive Project Records
A ransomware post names PIC Group, Inc. and claims 8 GB of corporate data is pending release, but the allegation remains unverified and the breach path is not established.
Nightspire Listing Puts Cognosis Limited in the Spotlight, But Proof Is Still Thin
A fresh victim listing has appeared, yet the public record does not confirm a breach, stolen data, or any operational impact.
Port Terminal Leak Claim Puts Operational Records Under a Threat Lens
A ransomware listing linked to N0n names Pusan Newport Company and points to sensitive terminal records, but the exposure claim is not independently verified.
Port Extortion Post Puts Shipping Records Under a Harsh Spotlight
A victim entry tied to Indonesia’s port logistics sector highlights how manifest and EDI data can become leverage in ransomware-driven pressure campaigns, even while the key claims remain unverified.
Extortion Claim Targets Shipping Records, Not Just Cargo
A new victim listing tied to a Japan-based ferry and RoRo operator shows how freight and payment files can become leverage before any breach is proven.
Maritime Finance Records Pulled Into a Leak-Site Pressure Play
A leak-site post alleges exposure of internal financial records from a South Korea ship management company, but the claimed impact remains unverified.
MoneyGram Lands in an Extortion Claim as Defenders Watch the Trust Layer
A ransomware listing tied to Thegentlemen puts a payments brand in the spotlight, but the available material stops short of proving a breach, data loss, or operational takeover.
A Public Victim Post Puts Confluent in the Extortion Spotlight
The only confirmed fact is narrow: Thegentlemen has publicly named Confluent, while the technical path, data scope, and real impact remain unverified.
Leak-Page Claims Put BigID in the Extortion Crosshairs
A ransomware-linked victim listing naming BigID is a reminder that a public claim can create immediate risk, even before any intrusion details are verified.
When Remote Access Becomes the Ransomware Doorway
A reported authentication-bypass flaw in Palo Alto Networks access products is being used as an entry path into internal networks, with ransomware operators among the named users of the weakness.
Extortion Post Names a Fresh Victim, but the Real Damage Remains Unproven
A new victim listing tied to N0n fits a familiar ransom pattern, yet the public record still stops short of proving what was taken or whether anything has been published.
Leak-Site Clock Ticks, But the Breach Remains Unproven
A new victim entry linked to N0n names a Michigan cannabis operator and sets a future publication time, yet the listing alone does not confirm a successful intrusion or data theft.
Clock-Ticking Ransomware Listing Puts a Florida Firm in the Spotlight
A newly posted victim entry attributed to N0n shows how an unverified listing can signal potential operational and reputational risk without proving a breach.
Rhysida’s Latest Leak Claim Puts Legal Finance Records in the Spotlight
A new extortion-style victim page names Reed & Giordano PA and lists sensitive files that could create fraud and privacy risk if the claims are accurate.