HEXSENTINEL
Binary & Malware Analyst
Professional Profile
HexSentinel reads machine code as if it were literature. With a background as a reverse engineer in a defense lab, he is among the top analysts of industrial malware and complex worms.
Key Skills
Advanced reverse engineering; Low-level binary analysis; Deobfuscation and unpacking; ICS/SCADA malware behavior analysis; Complex YARA signature development
Major Achievements
Disassembled an ICS malware in 16 hours, tracing it back to the attacker's toolchain.; Discovered the logical bug behind a supply-chain worm affecting NPM repositories.
Articles by HEXSENTINEL
Ransomware Crews Expand Pressure on a GlobalProtect Flaw
Multiple ransomware groups are reportedly widening their focus on a high-severity vulnerability in Palo Alto Networks’ GlobalProtect portal, but the full incident picture remains unconfirmed.
VPN Access Point Put in the Ransomware Crosshairs
A reported authentication-bypass flaw in PAN-OS has been tied to GlobalProtect access patterns, but the breach picture and any downstream damage remain unconfirmed.
Booba Listing Highlights How Ransomware Claims Can Increase Pressure
A medical practice was named in a victim listing, but the alleged 10 GB theft remains unverified and no public evidence confirms a breach.
Alleged Data Haul Puts Everett City Hall in the Ransomware Crosshairs
A victim listing tied to Everett, Massachusetts, claims 15 GB of data was taken, but the allegation remains unverified and the breach picture is still incomplete.
Claimed City Data Dump Brings Mt. Angel Into the Ransomware Spotlight
A listing tied to “Booba project” reportedly names the City of Mt. Angel, Oregon, and claims 18 GB of stolen data, but the incident itself is not independently confirmed.
Victim Listing Names Pearland Pediatrics, but the Theft Claim Still Needs Proof
A public listing tied to the Booba project names Pearland Pediatrics and reports 35 GB of stolen data, but the underlying incident remains unverified in the material provided.
Extortion Listing Triggers Questions Around a Medical Practice and a Claimed 3 GB Leak
Chicago Vein Institute has been named in a Booba project victim listing, but the alleged data theft remains unverified and the 3 GB figure should be treated cautiously.
Criminals Are Using AI to Hunt for the Data That Hurts Most
A recent Zscaler ThreatLabz report points to generative AI being used to sharpen phishing, speed reconnaissance, and target sensitive data for more selective extortion.
Fisher59 Enters the Anubis Ledger, but the Breach Claim Remains Unconfirmed
A victim listing names Fisher59 and frames the case as a beverage distributor data breach, yet the available material does not independently confirm what happened, what was taken, or whether the claim is accurate.
Payload Lists Brüninghoff Group, but the Breach Picture Is Still Thin
A victim listing can intensify pressure, yet this case remains unconfirmed as a successful intrusion, with no public evidence of data theft, ransom demands, or operational disruption.
Victim Listing Puts a New York Law Firm in the Crosshairs, but the Claim Remains Unproven
A ransomware-style post attributed to Global Secret Group names Rosenberg & Pittinsky, LLP and cites a large data count, yet the listing itself does not confirm compromise.
A Victim Listing Alone Is Not Proof, But It Still Raises Pressure
A Qilin-linked victim post naming Johnson & Pace is an unverified signal, not confirmation of a ransomware incident, yet it still carries reputational and operational risk.
Ransomware Listing Puts Hotel DuPont’s Phone Systems and Credentials in the Spotlight
An unverified extortion post names the hotel and claims network and telephony material was exposed, but the technical impact remains unconfirmed.
A Listing, Not a Verdict: The N0n Entry That Put One Retail Name in the Frame
A ransomware victim label tied to N0n names an unnamed U.S. automotive retailer, but the exposure remains pending and no breach has been independently confirmed.
Storm Listing Puts Patriot Maritime in the Extortion Spotlight - But the Facts Stop Short of a Breach
A victim post can be a warning sign, a pressure tactic, or both, but it is not proof that data was taken or systems were encrypted.
Ransomware Claim Lands on Baltimore Tank Lines, But Proof Is Still Thin
A victim listing names Baltimore Tank Lines, yet the available record does not independently confirm a breach, data theft, or operational disruption.
Claimed Leak Threads Payment Systems to Cloud Secrets, But Proof Remains Thin
A Ransomware.live listing alleges Finzly Corp is a victim and claims network configuration, payment-infrastructure access secrets, cloud topology, and access keys were exposed.
Unverified Leak Claim Turns Internal Maps Into Extortion Ammunition
A ransomware-style listing linked to Amagi Media Labs claims that network and device configuration files, plus internal network maps, were exposed, but the case remains unverified and the operational impact is unclear.
A 295.9 GiB Listing Surfaces, But the Breach Itself Is Still Unproven
A Ransomware.live entry names Iah6477 and mckenneys, yet the available material does not independently confirm a real incident, data theft, or publication.
Qilin Lists Llano Independent School District, But the Incident Is Not Verified
A victim listing can pressure a target, yet it does not by itself prove a breach, data theft, or an active ransomware event.