North Korean operators built a foothold on a DevOps engineer’s Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
Category: SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.
Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
Two Hugging Face accounts reveal that OpenAI’s agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline.
Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
Two Hugging Face accounts reveal that OpenAI’s agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline.
The Model Is the Malware | What Four Agentic Intrusions Tell Defenders
OpenAI, Anthropic and Meta disclosed agents reaching external systems. The tools didn’t matter, and that changes the playbook for investigating intrusions.
Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?
A real-world benchmark tests whether powerful AI models can keep an investigation trustworthy when new evidence invalidates their conclusions. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the world…
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
In April, SentinelLABS’ Tom Hegel published an initial assessment of the first five weeks of the conflict. Three months later, the evidence supports refinement. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers…
One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement
China and India ran separate espionage operations against the same Pakistani police force, each drawn by different stakes in Pakistan’s internal security. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light…
Context Engineering | Compaction & Agent Memory for Automated Malware Analysis
Compaction cut input tokens 86% across long-running agent evals with no quality loss. Context discipline matters as much as model selection. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on…
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegram C2 underneath. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on…
LABScon25 Replay | Keynote: Steps to an Ecology of Cyber
Decades of piling complexity onto non-standardized stacks have left security unsteerable. Juan Andrés Guerrero-Saade makes the case for a new approach. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on…
LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine
ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of…
LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout
Mick Baccio and Scott Roberts examine whether public breach signals and market timing models can turn cyber incidents into actionable trading opportunities. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light…
PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
Cloud attack framework skips cryptomining, harvests financial, messaging, and enterprise credentials for fraud, spam, and potential extortion. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware,…
LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience
Joe FitzPatrick reveals how consumer imports of networked devices pose a real security risk to small businesses and critical infrastructure alike. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on…
fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware,…
LABScon25 Replay | Are Your Chinese Cameras Spying For You Or On You?
Marc Rogers and Silas Cutler expose how cheap smart home devices conceal a shadow supply chain of shell companies, firmware flaws, and foreign data routing. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and…
Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis
Single-tool LLM analysis produces reports that look authoritative but aren’t. A serial consensus pipeline catches artifacts and hallucinations at source. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the…
LABScon25 Replay | Your Apps May Be Gone, But the Hackers Made $9 Billion and They’re Still Here
Andrew MacPherson exposes how crypto thieves exploit DeFi architecture, from the $1.5 billion Bybit heist to drainers-as-a-service and fund laundering. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the…
From Narrative to Knowledge Graph | LLM-Driven Information Extraction in Cyber Threat Intelligence
LLMs can turn CTI narratives into structured intelligence at scale, but speed-accuracy trade-offs demand careful design for operational defense workflows. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light on the…
Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails
Analysis of 175,000 open-source AI hosts across 130 countries reveals a vast compute layer susceptible to resource hijacking and code execution attacks. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and tinkerers shedding light…