Three regions. Three masters of the hunt. One global champion.

Explore the competition: s1.ai/S1-League

Asia Finalist Ethan Chew: Ethan's balance of skill, adaptability, and calm precision make him a threat across every surface, but he especially dominates in Endpoint.

Americas Finalist Derek Render: This U.S. flag hunter is in a league of his own for his unmatched ability to thrive under pressure as he seeks out and captures the game's hardest flags.

Europe Finalist Arnau Osso: A cloud maestro and relentless finisher, Arnau's precision and competitive drive led to perfect scores across Endpoint and Cloud.

Meet the finalists heading to OneCon for the Sentinels League Threat Hunting World Championship — where speed, precision, and nerve will decide who claims the crown.

Analysis by @hegel.bsky.social of @sentinellabs.bsky.social Labs
Full report → s1.ai/pcapt

Researchers also identified a related Android vector collecting location, contacts, and media — likely part of a broader surveillance effort.

Despite six months of prep, the infrastructure was active for just one day — suggesting deliberate exposure control and disciplined OPSEC.

The lure used a “Paste & Run” technique — a ClickFix-style prompt that convinces users to paste PowerShell commands manually, helping attackers evade file-based detection.

Victims were lured to a spoofed Zoom domain — zoomconference[.]app — which displayed a convincing fake Cloudflare verification page.

Behind it: a multi-stage PowerShell chain ending in a WebSocket-based RAT hosted on Russian infrastructure.

The campaign, which used a fake Cloudflare captcha page to deliver a WebSocket RAT, impersonated the Ukrainian President’s Office, sending weaponized PDFs to members of the:
– Red Cross
– UNICEF
– Norwegian Refugee Council
– Regional administrations across Donetsk, Poltava & Dnipropetrovsk

Why it matters: It’s the latest sign of disciplined cyber-espionage tactics designed to quietly gather intelligence on humanitarian and reconstruction efforts inside Ukraine. Six months of setup. One day online. Precision, not volume.

And we're live! www.youtube.com/live/vmKffVN...

Front-row access. No slides, no fluff. RSVP to our YouTube or LinkedIn livestreams to hear from @stonepwn3000.bsky.social, @jags.bsky.social, and Drea London—and to learn what we found, how we analyzed it, and what defenders should know next.

📺 YouTube: bit.ly/4kWpbAb
📲 LinkedIn: bit.ly/3JUw8oi

The Bottom Line: Harnessed correctly, agents don’t just automate analysis — they amplify tradecraft.

🎥 Watch the full replay: s1.ai/LC25-WP