HEXSENTINEL
Binary & Malware Analyst
Professional Profile
HexSentinel reads machine code as if it were literature. With a background as a reverse engineer in a defense lab, he is among the top analysts of industrial malware and complex worms.
Key Skills
Advanced reverse engineering; Low-level binary analysis; Deobfuscation and unpacking; ICS/SCADA malware behavior analysis; Complex YARA signature development
Major Achievements
Disassembled an ICS malware in 16 hours, tracing it back to the attacker's toolchain.; Discovered the logical bug behind a supply-chain worm affecting NPM repositories.
Articles by HEXSENTINEL
Deadlock Listing Casts a Fresh Shadow Over a Financial Services Firm
Union FA has been named in a ransomware victim listing, but the available facts do not confirm a breach scope, data theft, or root cause.
Settra Brings mcpolymers.com Into the Spotlight, But Proof Still Matters More Than the Post
A new victim entry tied to mcpolymers.com has appeared under the Settra name, yet the available record does not confirm a breach, data theft, or real-world disruption.
Settra Posts Baltimore Freightliner as a New Victim
A ransomware listing has linked Baltimore Freightliner to Harbor Truck Sales and Service, Inc., but the visible entry does not confirm a breach, stolen data, or the full scope of any impact.
Warlock’s SharePoint Push Exposes a Thin Edge in Critical Infrastructure
Exploitation of a widely used collaboration platform can become a serious security problem even when the full breach picture is still unclear.
Warlock Ransomware Group Tied to SharePoint Flaws in Reported Campaigns Against Sensitive Sectors
Symantec-linked findings point to targeting of water, telecom, and government organizations, but the full scope of any compromise remains unconfirmed.
Victim Listing Puts Vermont Health Care on Alert, But the Breach Picture Is Still Unclear
A ransomware victim claim can signal extortion pressure, yet it does not by itself confirm stolen data, encryption, or the full scope of any intrusion.
Genesis Listing Puts a Healthcare Provider on the Ransomware Radar
A victim claim involving TLC Perinatal is unverified, but it is enough to raise concern around a healthcare organization without proving a breach.
Victim Listing Leans on Staff and Customer Records in LA PONDEROSA Claim
A ransomware/extortion post tied to Emperador names a Venezuelan poultry business and alleges archives with personnel and customer data, but those claims remain unverified.
Pear’s Latest Victim Tag Points to Software Answers, but the Damage Trail Is Still Thin
A public victim entry names Software Answers, yet the evidence available here does not confirm compromise, data theft, or operational impact.
Payment-Themed Phishing, Malicious ISO Files, and WinMerge in a Global Group Ransomware Run
The campaign shows how routine business formats and trusted utilities can be folded into an encryptor delivery chain without needing exotic tooling.
Leak-Site Claim Puts a Retail Domain in the Extortion Spotlight
A Settra-branded victim entry tied to dfiretailgroup.com raises pressure and privacy concerns, but the alleged data scope remains unverified.
Victim Listing Puts Belgian Aluminium Maker in the Crosshairs, but Proof Is Thin
Thegentlemen has named Corswarem Group as a victim, yet the available material does not confirm breach scope, data theft, or any technical root cause.
Thegentlemen Publishes Don Hierro as a New Victim, But the Impact Remains Unclear
A ransomware victim listing puts the Panama-based engineering firm on alert, yet the available material does not confirm a breach, stolen data, or the scope of any disruption.
Extortion Listing Puts a New Jersey Eye Clinic in the Crosshairs
A ransomware victim post names Northern NJ Eye Institute, but the confirmed record stops at the listing itself and does not prove a breach, theft, or outage.
Victim Listing Turns a Paris Public-Benefits Group into an Extortion Signal
A victim listing attributed by Ransomware.live to Thegentlemen puts Agospap in the spotlight, while the technical reality behind any intrusion remains unverified.
Fresh Victim Claim Puts a Florida Design Firm in the Ransomware Spotlight
Thegentlemen has been linked to a new victim listing for Williamson Dacar Associates, but the public evidence still leaves the technical path and true impact unresolved.
Thegentlemen Lists Custom Rx Shoppe as a New Victim
A ransomware-linked victim entry names the Washington pharmacy, but the technical path, scope, and any data impact remain unconfirmed.
Extortion Post Names Grenoble Printer Europrim, But the Technical Picture Stays Murky
A ransomware listing tied to Thegentlemen places Europrim in the spotlight, yet the available record does not confirm breach scope, data theft, or the route in.
Victim Listing Lands Solaria in an Extortion Spotlight, but Proof Remains Thin
A public ransomware listing can create pressure fast, yet it does not by itself prove intrusion, theft, or operational disruption.
Ransomware Crew Puts Datacomm Services in the Spotlight
A new victim listing linked to TheGentlemen is enough to matter, even while the technical facts behind the claim remain unverified.