SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.
Category

Labs

Defeating macOS Malware Anti-Analysis Tricks with Radare2

Learn how to beat malware authors' control flow and avoid executing unwanted parts of their code to analyze macOS malware in radare2.

Read More

CVE-2021-3437 | HP OMEN Gaming Hub Privilege Escalation Bug Hits Millions of Gaming Devices

A high severity flaw in HP's OMEN Gaming Hub software allows any user to escalate privileges to kernel-level mode.

Read More

Hide and Seek | New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms

A new ZLoader campaign abuses Google Ads to target European banking institutions with signed MSI payloads and more than 300 domains.

Read More

EGoManiac | An Unscrupulous Turkish-Nexus Threat Actor

EGoManiac is a threat actor willing to spy on friend and foe and entrap journalists without compunction. Read our groundbreaking research.

Read More

6 Pro Tricks for Rapid macOS Malware Triage with Radare2

Learn more about reversing real-world macOS malware in this new series for intermediate to advanced analysts, starting with these r2 tips!

Read More

Hive Attacks | Analysis of the Human-Operated Ransomware Targeting Healthcare

Hive is a double-extortion ransomware group that’s hit over 30 organizations. Read our deep-dive into the ransomware toolkit.

Read More

ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage

Supplying a custom backdoor to a cluster of APT groups, the personas behind ShadowPad have maintained a cloak of secrecy, until now.

Read More

Massive New AdLoad Campaign Goes Entirely Undetected By Apple’s XProtect

Learn how to detect the latest variant of this widespread adware and browser hijacker, its infection pattern and indicators of compromise.

Read More

Hotcobalt – New Cobalt Strike DoS Vulnerability That Lets You Halt Operations

CVE-2021-36798 is a vulnerability in Cobalt Strike server that could allow victims to register a fake Beacon and DoS attackers.

Read More

MeteorExpress | Mysterious Wiper Paralyzes Iranian Trains with Epic Troll

In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.

Read More