SentinelOne / SentinelLabs
sentinellabs · B · active
https://www.sentinelone.com/labs/
SentinelLabs CTI/research arm, APT, ransomware, and cloud-native attack research (added 2026-05-08). 2026-05-08 audit: WebFetch returned 5 dated articles latest 2026-05-07 (PCPJack cloud worm, LABScon25 Replay sessions, Multi-Agent LLM malware analysis). RSS at https://www.sentinelone.com/labs/feed/ also works. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://www.sentinelone.com/labs/ (listing) then webfetch per-article URL; RSS at https://www.sentinelone.com/labs/feed/. AVOID: No issues; WebFetch works on listing and detail. Note recent feed is heavy on LABScon25 conference replays (still substantive technical writeups).. | 2026-07-05 admiralty audit: B, vendor threat-research lab, original malware/APT research; live and drillable. Status stays active. | 2026-10-02 (2026-10-02T0404Z-intel): article URLs now live on sentinellabs.com/labs/ (WebFetch listing); `extract https://www.sentinelone.com/labs/` shows dates (newest post 2026-09-18 at probe). | 2026-10-07 (S3): `url https://sentinellabs.com/labs/` returns 404 and `extract` on www.sentinelone.com/labs/ gives dates without hrefs; WebFetch on www.sentinelone.com/labs/ with an href-and-date prompt returns the posts with dates and sentinellabs.com/labs/<slug> hrefs; keep fetch_method webfetch. | 2026-10-11 (S3): the raw `url https://www.sentinelone.com/labs/` listing returns embedded JSON with published_date epochs, which gives the dates the listing page hides. | 2026-11-03 (S3): WebFetch answered 429 and extract a Vercel checkpoint page on the labs index; `fetch_source.py feed https://www.sentinelone.com/labs/feed/ 8` reads directly with dated items (newest 2026-10-28), so the feed is pinned as rss_url. | 2026-11-04 (intel run 2026-11-04T0256Z): feed https://www.sentinelone.com/labs/feed/ reads directly; `extract` of an article is served through the reader (direct fetch blocked).
Cited in 8 entries
Citation cadence
Citation days per ISO week (23 weeks of coverage span, total 8).
- Danfoss AK-SM and AK-SC, Copeland xweb and Dixell xweb refrigeration controllers compromised, with forced defrost at hundreds of French supermarkets, refrigeration failures at more than 115 shops in at least six more countries and first cases in Germany, and on 2026-11-02 altered settings in the cold rooms of the French blood service through a refrigeration supplier; responsibility not established; ENISA and Europol call for immediate action2026-10-13
- TraderTraitor (Jade Sleet) backdoors resurface on a non-cryptocurrency IT-services firm in a campaign that delivers malware through weaponized Terraform provider lockfiles, resolving C2 through a Nostr-relay dead drop2026-09-21
- CVE-2025-25249, Fortinet FortiOS/FortiSwitchManager: unauthenticated CAPWAP heap overflow added to CISA KEV, actively exploited since July via the PivotC2 RAT2026-09-10
- Hugging Face: a fully autonomous AI agent breached production, ran 17,000+ actions before detection2026-07-21
- Espionage actors weaponise a citizen-facing e-government complaint portal as a watering hole, serving a fake 'portal update' that reflectively loads a RAT2026-07-10
- macOS.Gaslight, a DPRK-aligned Rust backdoor that targets the LLM-assisted analyst2026-06-26
- SentinelOne "Living Off the Pipeline": attackers subverted TeamCity, GitLab automation, self-hosted runners and developer workstations in 20252026-05-16
- Checkmarx Jenkins AST plugin backdoored: rogue build 2026.5.09 swept build hosts for credentials on 2026-05-09/10, the third wave of malicious Checkmarx artifacts since March (TeamPCP claimed)2026-05-12