HEXSENTINEL
Binary & Malware Analyst
Professional Profile
HexSentinel reads machine code as if it were literature. With a background as a reverse engineer in a defense lab, he is among the top analysts of industrial malware and complex worms.
Key Skills
Advanced reverse engineering; Low-level binary analysis; Deobfuscation and unpacking; ICS/SCADA malware behavior analysis; Complex YARA signature development
Major Achievements
Disassembled an ICS malware in 16 hours, tracing it back to the attacker's toolchain.; Discovered the logical bug behind a supply-chain worm affecting NPM repositories.
Articles by HEXSENTINEL
Storm Listing Puts Patriot Maritime in the Extortion Spotlight - But the Facts Stop Short of a Breach
A victim post can be a warning sign, a pressure tactic, or both, but it is not proof that data was taken or systems were encrypted.
Ransomware Claim Lands on Baltimore Tank Lines, But Proof Is Still Thin
A victim listing names Baltimore Tank Lines, yet the available record does not independently confirm a breach, data theft, or operational disruption.
Claimed Leak Threads Payment Systems to Cloud Secrets, But Proof Remains Thin
A Ransomware.live listing alleges Finzly Corp is a victim and claims network configuration, payment-infrastructure access secrets, cloud topology, and access keys were exposed.
Unverified Leak Claim Turns Internal Maps Into Extortion Ammunition
A ransomware-style listing linked to Amagi Media Labs claims that network and device configuration files, plus internal network maps, were exposed, but the case remains unverified and the operational impact is unclear.
A 295.9 GiB Listing Surfaces, But the Breach Itself Is Still Unproven
A Ransomware.live entry names Iah6477 and mckenneys, yet the available material does not independently confirm a real incident, data theft, or publication.
Qilin Lists Llano Independent School District, But the Incident Is Not Verified
A victim listing can pressure a target, yet it does not by itself prove a breach, data theft, or an active ransomware event.
Settra Listing Turns a Procurement Paper Trail Into a Ransomware Question
adapt-global.com has appeared in a Settra-linked victim listing, but the available material stops short of proving a breach, data theft, or the authenticity of the documents described in the summary.
Victim Listing, Not Proof: Settra’s Claim Lands on a Norwegian Agency
A public victim entry naming Konsis Grafisk AS shows how extortion claims can move faster than verification, leaving defenders to separate allegation from evidence.
Victim Listing Puts Binsky & Snyder Under a Ransomware Lens
A posting tied to Settra names binsky.com, but the wider breach picture remains unverified and should be treated as a claim, not proof.
A Victim Label Appears, but the Evidence Still Has Not Caught Up
A listing tied to N0n and a US home services advertising category has surfaced, but the available material still does not confirm a real breach, theft, or identified victim.
Settra Claims a New Victim in Konsis Grafisk AS
A claimed publication and data-holding event involving the Norwegian agency remains unverified, but it still signals extortion pressure worth tracking.
Victim Label, Loose Documents, and a Ransomware Claim That Still Needs Proof
A Settra victim listing tied to Passavant Energy & Environment GmbH raises a narrow question: which parts of the surrounding paperwork are real, and which parts are simply pressure?
Settra’s Victim Tag Raises Questions, Not Proof, Around a Czech Packaging Supplier
A ransomware claim tied to Marvinpac CZ remains unverified, but it highlights the risk profile of supplier-facing businesses that sit close to customer and logistics data.
Credentials on the Line: A Ransomware Claim Built Around Access, Not Just Data
A disputed extortion listing tied to SQA Services Inc centers on alleged VPN access, internal network details, and test-environment configuration, but none of it is independently confirmed.
Victim Label Lands Before Proof in Freight Sector Ransomware Case
A post linked to Eclipse names Global AirFreight International, but the available material does not independently confirm a breach, data theft, or operational disruption.
Helix’s Latest Victim Post Leaves a Thin Evidence Trail Behind the Threat
A named company, a revenue figure, and a timed link release are being tied to a new victim claim, but the underlying data and impact remain unverified.
Thin Victim Post, Real-World Risk: N0n’s Latest Unverified Listing
A posted entry tied to N0n points to an unnamed U.S. real estate and land development company, but the exposure claim remains unconfirmed and the technical picture is still thin.
Anonymous Listing, Unclear Damage: N0n’s Latest Victim Post Raises More Questions Than Answers
A newly posted victim entry tied to an unnamed US IT services company is reported with “pending exposure,” but no verified evidence yet shows breach, theft, or disruption.
Unverified Everest listing puts Brenner Base Tunnel on the ransomware radar
A victim label on an extortion page is not proof of compromise, but it is enough to raise scrutiny around a major cross-border rail project.
Unverified Everest Victim Label Puts Chugoku Bend Under a Cloud of Doubt
A reported victim listing tied to Everest names Chugoku Bend, but the available material does not independently confirm who the target is or whether any compromise occurred.