SentinelOne

🚨 This week, the FBI arrested a suspected ShinyHunters co-conspirator and the DOJ indicted 14 people over a North Korean IT worker scheme, while Ledger wallets have been compromised with hardware implants and attackers remotely defrosted refrigerators across French supermarkets. 🚦 The Good: The FBI arrested a suspected ShinyHunters co-conspirator linked to the group’s alleged breach of FBIjobs.gov. Reports identify him as Canadian cybersecurity executive Edward Dubrovsky, but the FBI has not confirmed this. The FBI says the ShinyHunters and its associates have breached more than 140 organizations and collected over $70 million in extortion payments. Separately, the DOJ indicted 14 people involved in North Korean remote IT worker schemes affecting more than 70 U.S. companies. Two U.S. nationals were arrested, and the FBI seized about 187 devices in searches of known or suspected laptop farms in Texas. The Bad: Ledger confirmed that customer wallets sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant. Researchers say tampered devices were sold at nearly half the original price. Ledger has asked sellers across Asia to halt sales and urged affected users to move their assets to a new device with a new seed. The Ugly: Attackers remotely defrosted refrigeration systems at hundreds of French supermarkets, including Intermarché and Coopérative U. The attack reportedly targeted Danfoss and Copeland/Dixwell refrigeration controllers, causing food waste and significant financial losses. Paris prosecutors have opened an investigation. This was the week in cyber.

When insurance underwriters evaluate other companies, they call Yahoo’s cybersecurity “the gold standard.” Hundreds of millions of people trust Yahoo with their digital lives. The team protecting it, The Paranoids, faces nation-state campaigns and large-scale credential abuse every day. They chose SentinelOne to secure 400,000 endpoints across a global hybrid environment, fully deploying in about four months, with zero coverage gaps along the way. The result is more than coverage. Forensic data collection that once took days of cross-team coordination now takes minutes, with analysts using Purple AI to hunt threats in plain English. 🔗 Read the full Yahoo story: https://lnkd.in/eV75qXyG

Cybersecurity research, moving from weeks to hours. SentinelOne’s Gregor Stewart describes OpenAI’s cyber capabilities reaching human-level output in about eight hours on reverse-engineering work that would take a top researcher four to six weeks. That lets security teams investigate more malware, connect related threats and keep a clearer picture of how attacks are evolving. “That’s a kind of intelligence that we were never able to afford before.” Watch Gregor explain what faster research makes possible. https://lnkd.in/e6cWiaP5

In seven days, the security conversations that matter are happening in one building in Las Vegas. Your peers will be there. The practitioners, the threat hunters, the researchers, the engineers, the people you follow, the people you learn from, the people you want to be in the room with. 🎙️ Keynotes from Hector Monsegur + Chris Tarbell 🏆 The Sentinels League, the world’s best threat hunters competing LIVE for $100K ⚡ Hands-on labs, closed-door roundtables, and the hallway conversations that never get recorded https://s1.ai/6fe925

Somewhere in Times Square, onlookers just looked up from their phones and read, “The world runs on AI. We secure it.” SentinelOne was built for autonomous security from day one. As AI changes both what enterprises need to secure and how security teams operate, we're focused on two things: securing AI and helping the SOC operate at machine speed. Our vision is a safer future for humanity. Our purpose is to give the advantage to those who secure our future. Turns out, some messages are better at billboard size.

At OneCon, we're hosting the ultimate arena for cyber defenders: The Sentinels League Threat Hunting World Championship. We're bringing together the top SOC analysts, threat hunters, and cyber guardians from around the world to battle it out on stage. Witness it all first-hand: raw skill, live threat hunting, and the crowning of a world champion. 🗓️ October 20–22, 2026 📍 Only at OneCon Everyone knows at least one legendary hunter who can sniff out the most mysterious of anomalies in raw logs. Who is stepping into the arena to stop a doomsday event that you are rooting for? Tag them below! 👇

🚨 This week, a suspected ShinyHunters admin was reportedly detained in Jordan, the DOJ charged a ransomware remediation owner with fraud and sentenced a dark web market co-creator to 40 years, while fake AI ad portals phished credentials and MFA codes, and a critical Atlassian flaw drew attacks within two hours of exploit details. 🚦 The Good: Jordanian authorities reportedly detained ShinyHunters suspect Saif al-Din Khader, who is said to be cooperating with the FBI to locate other members of the group. The DOJ indicted MonsterCloud owner Zohar Pinhasi with wire fraud for allegedly paying ransomware attackers behind clients' backs after promising proprietary decryption. Empire Market co-creator Raheim Hamilton was sentenced to 40 years in federal prison for running a dark web marketplace that facilitated more than four million transactions worth over $430 million. The Bad: Cyber researchers disclosed a human-operated phishing platform impersonating ad tools for ChatGPT, Gemini, Claude, Perplexity, Meta Muse, and Manus. It uses browser-in-the-browser windows with spoofed address bars to capture credentials, while an operator steers victims through MFA challenges in real time. Targets include agency staff and ad manager account administrators. The Ugly: Attackers have begun exploiting CVE-2026-21589, a CVSS 9.3 unauthenticated file access flaw in Atlassian Data Center products including Jira, Confluence, Bitbucket, and Crowd. Exploitation attempts started within two hours of the technical details being published. The flaw can expose Atlassian Crowd and Jira credentials that lead to administrative access. This was the week in cyber.

"Even when you think there isn't a way, start looking for another solution. Look at it differently." For Xochitl Ledesma, Senior Director, Customer Strategy & Operations at SentinelOne, that mindset started long before her career and it’s one she’s carried into every role since. Growing up in a Mexican household, Xochitl learned from her mother to approach challenges with persistence and curiosity. When something wasn't working, the guidance was simple: analyze the problem, look at it from another angle, and find a different way forward. Xochitl brings that same instinct to her work every day. It shapes how she approaches complex challenges, how she collaborates across the business, and how she helps find better paths forward for customers. This Hispanic Heritage Month, Xochitl's story is a reminder that some of the most powerful leadership frameworks come from the people who raised us. The lessons we inherit can become the greatest strengths we bring to our careers. 👉 Read Xochitl's story: https://s1.ai/HHM-2026

AI software guardrails live in software that models can reach, bypass, or disable. This edition of Code Purple covers what a real enforcement layer looks like. Inside this newsletter: 🔐 Governing AI From Silicon to Runtime: Tomer Weingarten published a new blog detailing SentinelOne's collaboration in NVIDIA's Open Agent Safety Platform. 💀 The EDR Killer Economy: SentinelLABS kicks off a new BYOVD blog series tracing how endpoint defense evasion evolved into a mature service economy. 🏫 Customer Spotlight: Halton District School Board: 5,000 daily alerts down to fewer than five. Investigation time from a full day to about one hour. Seven days of manual work per month eliminated through automation. Read the full edition here:

Every LABScon began with the same idea: put the research front and center. That idea became a community. LABScon 2026 brought it full circle, with the researchers, defenders, and industry builders who made it what it is. Thank you to everyone who showed up, shared their work, and made the last LABScon the best one ever.