Lightnews — Scholar-powered news

SentinelLABS @sentinellabs.bsky.social · 21d

🔥🔥 Fresh research drop live from #labscon Arizona. @alex.leetnoob.com and @morecoffeeplz.bsky.social with @vkamluk.bsky.social
The Hunt for LLM-enabled malware #ai #cyber #threatintel
s1.ai/llm-mw

Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware

LLM-enabled malware poses new challenges for detection. SentinelLABS presents groundbreaking research on how to hunt for this new class of threats.

s1.ai

4 4

SentinelLABS @sentinellabs.bsky.social · 27d

Reddit AMA with our very own @dakotaindc.bsky.social—ask him anything here: www.reddit.com/r/geopolitic...

2 4

Reposted by SentinelLABS

Aleksandar Milenkoski @milenkowski.bsky.social · Sep 4

🚨New research drop: Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

It was a pleasure collaborating with Sreekar Madabushi and @kennethkinion.bsky.social from Validin!

Read our blog post: s1.ai/nk-ops

Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

DPRK-aligned threat actors abuse CTI platforms to detect infrastructure exposure and scout for new assets.

s1.ai

1 6 9

Reposted by SentinelLABS

SentinelOne @sentinelone.com · Aug 26

🏆 Bragging rights, a $100K Prize Pool, and an all-expenses-paid trip to SentinelOne’s OneCon conference in Las Vegas. 🎰 Step up, test your skills, and claim your crown 👑

Sign up below (includes details on terms and conditions):

Threat Hunting World Championship 2025 | SentinelOne

Win from a $100K prize pool in SentinelOne’s 2025 Threat Hunting Championship. Compete in detection challenges. Register today!

s1.ai

1 2

Reposted by SentinelLABS

SentinelOne @sentinelone.com · Aug 25

The Cyber Patents China Didn’t Want Us to Find: @dakotaindc.bsky.social and @sentinellabs.bsky.social uncovered 10+ patents for highly intrusive forensics and data collection tools—filed by companies named in U.S. gov't. indictments for working with the Chinese Hafnium (aka Silk Typhoon) APT group.

China’s Covert Capabilities | Silk Spun From Hafnium

China-linked hackers used patented spyware tech from front companies tied to Hafnium, exposing gaps in cyber threat attribution.

s1.ai

1 1 3

SentinelLABS @sentinellabs.bsky.social · Aug 6

🔥 Fresh from the LABS team and our friends at Beazley Security 👇https://www.sentinelone.com/labs/ghost-in-the-zip-new-pxa-stealer-and-its-telegram-powered-ecosystem/

Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem

PXA Stealer uses advanced evasion and Telegram C2 to steal global victim data, fueling a thriving cybercrime market.

www.sentinelone.com

1 1 2

Reposted by SentinelLABS

Fran Donoso @francisck.com · Aug 4

Our team collaborated with our friends at @sentinellabs.bsky.social to identify and disrupt a PXA infostealer campaign that has an intricate and complex delivery chain:

labs.beazley.security/articles/gho...

Thanks for the fantastic collab SentinelLabs team!

BSL - Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem

labs.beazley.security

2 3

SentinelLABS @sentinellabs.bsky.social · Jul 30

🌀🔥… the complex relationship btw CN APTs🕵️‍♂️ and CN PSOAs 🇨🇳 makes attribution even more challenging than defenders might have supposed. #cti #threatintel #hafnium #silktyphoon @dakotaindc.bsky.social

www.sentinelone.com/labs/chinas-...

China’s Covert Capabilities | Silk Spun From Hafnium

China-linked hackers used patented spyware tech from front companies tied to Hafnium, exposing gaps in cyber threat attribution.

www.sentinelone.com

2 2

Reposted by SentinelLABS

Ryan Naraine @ryanaraine.bsky.social · Jul 27

This week's show is YouTube ready @craiu.bsky.social @jags.bsky.social

🔥 Microsoft Sharepoint security crisis: Faulty patches, Toolshell zero-days

youtu.be/3GJuVGmpexA

Microsoft Sharepoint Security Crisis: Faulty Patches, Zero-Day Exploits

YouTube video by Three Buddy Problem

youtu.be

4 8

SentinelLABS @sentinellabs.bsky.social · Jul 27

⚠️ #0-DAY #Microsoft
👾 #CVE-2025-53770
🔩 #ToolShell 🪏
bsky.app/profile/sent...

SentinelOne @sentinelone.com · Jul 21

🚨 SentinelOne Uncovers 3 Distinct Attack Clusters Targeting Microsoft SharePoint: As part of the “ToolShell” Zero-Day being exploited in-the-wild, our threat researchers have identified three distinct attack clusters, each with unique tradecraft and objectives.

SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers

SentinelOne shares distinct attack clusters and a detailed timeline of events on an active exploit of the ToolShell 0-day in MS SharePoint.

s1.ai

2 2

Reposted by SentinelLABS

Phil Stokes ⫍🐠⫎ @philofishal.bsky.social · Jul 27

👀 Apple: “macOS is secure by design.”
💻 Meanwhile, in /Users/Shared:
🕵️‍♂️ Persistent Malware masquerading as Apple “agent”
>> Khepri beacon in /tmp
📦 Ad-hoc signed payloads
🌍 Targeting Chinese diaspora
Deep dive from Dinesh Devadoss and me 👉 s1.ai/zuru
#icymi #macOS #malware #APT #infosec

macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App

ZuRu malware continues to prey on macOS users seeking legitimate business tools, adapting its loader and C2 techniques to backdoor its targets.

s1.ai

1 6 8

SentinelLABS @sentinellabs.bsky.social · Jul 2

💥 Fresh from LABS @philofishal.bsky.social and @syrion89.bsky.social
Our guys untangle the knots of #NimDoor: compiled Nim, macOS process injection and signals-based persistence triggers, with AppleScript (⁉️) beacons (whatever will they think up next 😅) 🌶️🌶️.
#dprk #apt #macOS
s1.ai/nimdoor

macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware

NimDoor reflects a leap in DPRK’s offensive toolkit, mixing compile-time trickery with native scripting to complicate and deter analysis.

s1.ai

3 3

Reposted by SentinelLABS

Ryan Naraine @ryanaraine.bsky.social · Jun 21

This week's show is a three-hour deep dive into Predatory Sparrow and the long-simmering Iran-Israel cyberwar (with @darkcell.bsky.social @craiu.bsky.social @jags.bsky.social youtu.be/MKKzHseTUUQ?...

Israel-Iran cyberwar: Predatory Sparrow, vanishing crypto, bank hacks

YouTube video by Three Buddy Problem

youtu.be

3 4

Reposted by SentinelLABS

Ryan Naraine @ryanaraine.bsky.social · Jun 14

"The best netflow comes from asking friends for favors." -- @jags.bsky.social @craiu.bsky.social

1 2 9

Reposted by SentinelLABS

Aleksandar Milenkoski @milenkowski.bsky.social · Jun 9

Get the full story here:

www.sentinelone.com/labs/follow-... [2/2]

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

This report uncovers a set of related threat clusters linked to PurpleHaze and ShadowPad operators targeting organizations, including cybersecurity vendors.

www.sentinelone.com

1 3

Reposted by SentinelLABS

Aleksandar Milenkoski @milenkowski.bsky.social · Jun 9

We just released our findings on long-term activity clusters attributed to China-nexus actors.

We discuss a relatively underreported, yet critical, aspect of the threat landscape: the targeting of cybersecurity vendors.

Big shout out to Lumen's Black Lotus Labs for their support! [1/2]

1 4 6

Reposted by SentinelLABS

SLEUTHCON @sleuthcon.bsky.social · May 1

From PhD work to award-winning cybercrime research, @milenkowski.bsky.social of SentinelLABS is a force in malware analysis.

Catch his talk at #SLEUTHCON 2025!

🎟️ Grab your ticket today >>> www.sleuthcon.com

#CyberThreatIntel #InfosecEvents

2 4

Reposted by SentinelLABS

SentinelOne @sentinelone.com · Apr 29

📄 Read the full research: s1.ai/TopTier

Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries

This report highlights a rarely-discussed but crucially important attack surface: security vendors themselves.

s1.ai

4 7

Reposted by SentinelLABS

1steve 1stone @stonepwn3000.bsky.social · Apr 28

Love when we can talk about hoy dynamic the threat landscape actually is. The scope and scale of the DPRK IT workers effort alone surprised me as we worked it. Also love @sentinelone.com let us discuss this openly and viewed it as important to do so.

www.sentinelone.com/labs/top-tie...

Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today's Adversaries

This report highlights a rarely-discussed but crucially important attack surface: security vendors themselves.

www.sentinelone.com

3 5

Reposted by SentinelLABS

Martin Wendiggensen @machinavelli.com · Apr 25

Appreciate the shoutout @jags.bsky.social (and that you aced my last name)! If you don’t listen to the Three Buddy Podcast yet, it is absolutely amazing and you should!

open.spotify.com/show/6dXbRag...

Tom Rid joins the show: AI consciousness, TP-Link's China connection, trust in hardware security

open.spotify.com

1 4 11

Reposted by SentinelLABS

Kenneth Kinion @kennethkinion.bsky.social · Apr 24

At @pivotcon.bsky.social, I'm presenting with @hegel.bsky.social and Sreekar Madabushi on the first public look at the full scope of a stealthy, long-running phishing network.

5 7

Reposted by SentinelLABS

Alex Delamotte @alex.leetnoob.com · Apr 25

Very excited to share that I’ll be presenting at @sleuthcon.bsky.social in June!

Jim & I will share the backstory behind AkiraBot that didn’t make it into the blog—and what they’ve been up to since.

3 12

Reposted by SentinelLABS

Max Smeets @maxwsmeets.bsky.social · Apr 23

Published a new Pharos report today - and learned a lot in the process from @milenkowski.bsky.social Jiro, @julianferdinand.bsky.social @tgrossman.bsky.social. The report takes a closer look at how states are using ransomware.

virtual-routes.org/wp-content/u...

1 9 14