🔥 New Research from @hegel.bsky.social 🔥 PhantomCaptcha: A short-lived, multi-stage PowerShell and WebSocket RAT operation targeting Ukraine-linked humanitarian and government entities. Full report: s1.ai/pcapt

🔥🔥 Fresh research drop live from #labscon Arizona. @alex.leetnoob.com and @morecoffeeplz.bsky.social with @vkamluk.bsky.social The Hunt for LLM-enabled malware #ai #cyber #threatintel s1.ai/llm-mw

Reddit AMA with our very own @dakotaindc.bsky.social—ask him anything here: www.reddit.com/r/geopolitic...

🚨New research drop: Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms It was a pleasure collaborating with Sreekar Madabushi and @kennethkinion.bsky.social from Validin! Read our blog post: s1.ai/nk-ops

🏆 Bragging rights, a $100K Prize Pool, and an all-expenses-paid trip to SentinelOne’s OneCon conference in Las Vegas. 🎰 Step up, test your skills, and claim your crown 👑 Sign up below (includes details on terms and conditions):

The Cyber Patents China Didn’t Want Us to Find: @dakotaindc.bsky.social and @sentinellabs.bsky.social uncovered 10+ patents for highly intrusive forensics and data collection tools—filed by companies named in U.S. gov't. indictments for working with the Chinese Hafnium (aka Silk Typhoon) APT group.

🔥 Fresh from the LABS team and our friends at Beazley Security 👇https://www.sentinelone.com/labs/ghost-in-the-zip-new-pxa-stealer-and-its-telegram-powered-ecosystem/

Our team collaborated with our friends at @sentinellabs.bsky.social to identify and disrupt a PXA infostealer campaign that has an intricate and complex delivery chain: labs.beazley.security/articles/gho... Thanks for the fantastic collab SentinelLabs team!

🌀🔥… the complex relationship btw CN APTs🕵️‍♂️ and CN PSOAs 🇨🇳 makes attribution even more challenging than defenders might have supposed. #cti #threatintel #hafnium #silktyphoon @dakotaindc.bsky.social www.sentinelone.com/labs/chinas-...

This week's show is YouTube ready @craiu.bsky.social @jags.bsky.social 🔥 Microsoft Sharepoint security crisis: Faulty patches, Toolshell zero-days youtu.be/3GJuVGmpexA

⚠️ #0-DAY #Microsoft 👾 #CVE-2025-53770 🔩 #ToolShell 🪏 bsky.app/profile/sent...

👀 Apple: “macOS is secure by design.” 💻 Meanwhile, in /Users/Shared: 🕵️‍♂️ Persistent Malware masquerading as Apple “agent” >> Khepri beacon in /tmp 📦 Ad-hoc signed payloads 🌍 Targeting Chinese diaspora Deep dive from Dinesh Devadoss and me 👉 s1.ai/zuru #icymi #macOS #malware #APT #infosec

💥 Fresh from LABS @philofishal.bsky.social and @syrion89.bsky.social Our guys untangle the knots of #NimDoor: compiled Nim, macOS process injection and signals-based persistence triggers, with AppleScript (⁉️) beacons (whatever will they think up next 😅) 🌶️🌶️. #dprk #apt #macOS s1.ai/nimdoor

This week's show is a three-hour deep dive into Predatory Sparrow and the long-simmering Iran-Israel cyberwar (with @darkcell.bsky.social @craiu.bsky.social @jags.bsky.social youtu.be/MKKzHseTUUQ?...

"The best netflow comes from asking friends for favors." -- @jags.bsky.social @craiu.bsky.social

Get the full story here: www.sentinelone.com/labs/follow-... [2/2]

We just released our findings on long-term activity clusters attributed to China-nexus actors. We discuss a relatively underreported, yet critical, aspect of the threat landscape: the targeting of cybersecurity vendors. Big shout out to Lumen's Black Lotus Labs for their support! [1/2]

From PhD work to award-winning cybercrime research, @milenkowski.bsky.social of SentinelLABS is a force in malware analysis. Catch his talk at #SLEUTHCON 2025! 🎟️ Grab your ticket today >>> www.sleuthcon.com #CyberThreatIntel #InfosecEvents

📄 Read the full research: s1.ai/TopTier

Love when we can talk about hoy dynamic the threat landscape actually is. The scope and scale of the DPRK IT workers effort alone surprised me as we worked it. Also love @sentinelone.com let us discuss this openly and viewed it as important to do so. www.sentinelone.com/labs/top-tie...

Appreciate the shoutout @jags.bsky.social (and that you aced my last name)! If you don’t listen to the Three Buddy Podcast yet, it is absolutely amazing and you should! open.spotify.com/show/6dXbRag...

At @pivotcon.bsky.social, I'm presenting with @hegel.bsky.social and Sreekar Madabushi on the first public look at the full scope of a stealthy, long-running phishing network.

Very excited to share that I’ll be presenting at @sleuthcon.bsky.social in June! Jim & I will share the backstory behind AkiraBot that didn’t make it into the blog—and what they’ve been up to since.

Published a new Pharos report today - and learned a lot in the process from @milenkowski.bsky.social Jiro, @julianferdinand.bsky.social @tgrossman.bsky.social. The report takes a closer look at how states are using ransomware. virtual-routes.org/wp-content/u...

👉 s1.ai/akirabot #OpenAI abused by spambot to carve out custom messages and beat CAPTCHAs. #security @alex.leetnoob.com 🕸️

it feels like an useful feature so I have just implemented it under aflmc. thanks for sharing your alias! github.com/radareorg/ra...

Learn how to pivot on network iocs you find in blog posts 🔥 #validin www.validin.com/blog/x-phish...

🔥⚔️ Presenting our Just A Sec livestream. In the first-ever episode on April 10 at 2 p.m. PT, @dakotaindc.bsky.social, Drea London, @jags.bsky.social, and @stonepwn3000.bsky.social discuss the hidden forces shaping our digital world.

Really great episode this week. The Signal ID management mess, and the lab dookhtegan topics.. simply delicious 🤌

Power up your #radare2 pifc command with a $pifc alias that sorts and counts the calls in a function. #macOS #reverseengineering #r2

s1.ai/LC24-CB ⌨️ 👉 🇨🇳 ☣️ Exploiting CTFs to tool-up your #espionage capabilities and build out your #cyberarsenal. ⚒️ 💣 @dakotaindc.bsky.social @sentinelone.com

s1.ai/LC24-JW 🔥🚰 leaky opsec reveals how Kryptina made a name for itself 👇 #ransomware #security #cyber

s1.ai/readup 🐚 Adware loaders are always the most complex! Props to @syrion89.bsky.social for helping me pull apart all these different bins and figuring out what they had in common and how to attribute and detect them. 🦾 #adware #malware #macOS #security @sentinelone.com @sentinellabs.bsky.social

s1.ai/LC24-WZ @kimzetter.bsky.social @dwizzzle.bsky.social

⚠️ Whose #farm is it anyway? 🍞🥦 s1.ai/LC24-Drd

SentinelLABS has observed a campaign targeting opposition activists in #Belarus and #Ukraine military and gov orgs. The campaign was in prep July-August 2024 but entered active phase in Nov-Dec 2024. Operation remains active in recent days. @hegel.bsky.social @sentinelone.com s1.ai/ghost-xl

The one where the state interferes with the private sector in order to manipulate public opinion. 🤝 #friends s1.ai/topsec

Sneaky! 🫣😶‍🌫️ #DPRK FERRET #macOS #malware has been tricking users into installing backdoors and trying to hide out behind fake Zoom, Chrome and Apple logd files. @philofishal.bsky.social @hegel.bsky.social s1.ai/Ferret

📸 Which seemingly US businesses are really a front for Chinese influence? Find out with @ellyrostoum.bsky.social and the latest from our #labscon talks.👇 s1.ai/Lc24-ER

#SCAM! ☣️ An active phishing campaign is targeting high-profile X accounts in an attempt to hijack and exploit them for fraudulent activity. #crypto @hegel.bsky.social @alex.leetnoob.com & Jim Walter 💥 s1.ai/XCrypto

Dive into the full research by Jim Walter of @sentinellabs.bsky.social: s1.ai/Hellmor

This #macOS backdoor uses /usr/bin/SetFile to hide itself in the Finder. SetFile was deprecated in Xcode 6 (that's 2014 to humans)...not sure why it makes sense to declare smth 'deprecated' then leave it in the OS for 10+ years. 🤷‍♂️ #apple #malware SHA1: 609088c54b99432aab212f35cfe74030b52f0320

🍎👿 The key macOS malware families of 2024: This past year saw a sharp rise in sophisticated campaigns targeting macOS users in the enterprise and the increasing adoption of cross-platform development frameworks.

#AI 👾 #Disinformation 🔊 and #election 🗳️ interference. Watch this cracking 25min talk on how these played out in Taiwan’s 2024 election. Not what the headlines predicted. 🔥 #labscon s1.ai/LC24-MW

🌐 Here are the most significant research findings from @LabsSentinel in 2024, from disruptive ransomware innovations and state-sponsored cyberespionage operations to the commoditization of malicious tools. ⏬ Scroll down to read the TL;DR of key trends 🧵 📄 Read the full blog post: s1.ai/labs24

🔮 What does the future hold? Surprises 🎲, certainly, but some of the forces that will shape #2025 can already be discerned in the shadows of 2024. The @sentinellabs.bsky.social team takes a look at what might be coming over the horizon for #cybersecurity this coming year.

🔥 NEW: Operation Digital Eye 👁️ | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels #apt #china #cyber s1.ai/d-eye

1) Many underestimate the investment the PRC has put into influencing the US social media sphere. 2) The destruction of Trust and Safety at X has made it a playground for PRC actors. 3) It's nice to see them whine about BlueSky. 4) But there is nothing magical about BlueSky to keep them away.