Aleksandar Milenkoski
@milenkowski
Followers
2K
Following
2K
Media
57
Statuses
568
Threat Research | Threat Intelligence | PhD | European Commission Marie Curie Research Fellow 2011-2014 | Personal Profile | 🇩🇪
Joined March 2012
Dropping this today: ChamelGang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware. In collaboration with @JulianVoeg from @RecordedFuture . 🧵A quick summary and a few thoughts on the use of RSW by APTs.
sentinelone.com
Threat actors in the cyberespionage ecosystem are using ransomware for financial gain, disruption, distraction, misattribution, and the removal of evidence.
1
29
68
Presenting at @HagueTIX with @JulianVoeg was an amazing experience! So many insightful talks! Huge thanks to the organizing team (@monica_kello, Corianne Oosterbaan, and the PC) for having me. Already looking forward to next year, wouldn’t miss it!
0
2
9
RT @JohnLaTwC: Think Deeper. One line of this @SentinelOne blog (🙏 @TomHegel and @milenkowski) stood out to me. 💭"Encrypts and password-p….
0
18
0
RT @780thC: Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets.June 9, 2025, Sentinel Labs..
sentinelone.com
This report uncovers a set of related threat clusters linked to PurpleHaze and ShadowPad operators targeting organizations, including cybersecurity vendors.
0
5
0
We just released our findings on long-term activity clusters attributed to China-nexus actors. We discuss a relatively underreported, yet critical, aspect of the threat landscape: the targeting of cybersecurity vendors. Big shout out to @BlackLotusLabs for their support! [1/2].
1
7
20
Huge thanks to the @SLEUTHCON team for having me and putting on such a great event! It was a pleasure presenting with Sreekar from @ValidinLLC on North Korean activities. Stay tuned, more to come from us soon.
0
8
22
RT @BfV_Bund: Das #BfV_Bund und weitere internationale Partner warnen aktuell vor Aktivitäten der russischen GRU-Einheit 26165, die eine Cy….
verfassungsschutz.de
Gemeinsam mit internationalen Partnern informieren der BND, das BSI und das BfV in einem Sicherheitshinweis über russische Cyberaktivitäten, die sich insbesondere gegen westliche Logistik- und...
0
318
0
RT @bindinghook: Read an excerpt from @milenkowski, @jirominier, @JulianVoeg, @Maxwsmeets, and Taylor @tgrossman_’s new report on state use….
bindinghook.com
The governments of Russia, China, Iran, and North Korea use ransomware for diverse ends.
0
2
0
It was a pleasure collaborating with @TomHegel and Jim Walter on this one. Read our blog here:. [2/2].
sentinelone.com
This report highlights a rarely-discussed but crucially important attack surface: security vendors themselves.
0
3
13
🚨New research drop: Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries. 🌐 China-nexus APTs targeting supply chains.🔍 DPRK IT workers infiltrating hiring pipelines.🛠 Ransomware crews probing EDR platforms [1/2].
1
15
37
Excited to be part of the incredible @SLEUTHCON lineup with the @ValidinLLC team!.
At @SLEUTHCON, Validin's Sreekar Madabushi presents with @milenkowski of @LabsSentinel on an exclusive view into suspected North Korean threat actor interest in threat intelligence data. You won't want to miss this spicy talk!
0
7
14
It was a pleasure to collaborate with @jirominier (@DCSO_de), @JulianVoeg (@RecordedFuture), @Maxwsmeets (@VirtualRoutes), and @tgrossman_. Read the report here: [2/2].
virtual-routes.org
The third report in the Pharos Series, Ransomware’s New Masters: How States Are Hijacking Cybercrime is authored by Aleksandar Milenkoski, Jiro Minier, Julian-Ferdinand Vögele, Max Smeets, and Taylor...
0
3
12
🚨New research drop: Ransomware’s New Masters: How States Are Hijacking Cybercrime. This @VirtualRoutes report offers a comparative analysis of ransomware use by suspected state-aligned clusters from Russia, China, North Korea, and Iran. [1/2]
1
7
17
RT @VirtualRoutes: 💡The third report of the Pharos Series, Ransomware’s New Masters: How States Are Hijacking Cybercrime by @milenkowski, @….
0
4
0
RT @securityaffairs: A data leak exposes the operations of the Chinese private firm #TopSec, which provides #Censorship-as-a-Service.https:….
securityaffairs.com
A leak suggests China's TopSec provides censorship services, aiding a state-owned firm during a corruption scandal.
0
4
0
RT @780thC: SentinelLABS has analyzed a data leak from TopSec, a Chinese cybersecurity firm offering services such as Endpoint Detection &….
sentinelone.com
Data leak reveals how a top tier cybersecurity vendor helps the PRC enforce content monitoring and manipulation of public opinion in China.
0
26
0
The leak provides insights into how private cybersecurity firms help the state and the CCP monitor and censor online discourse — especially during corruption scandals. [2/2]. 🔍 Read more:
sentinelone.com
Data leak reveals how a top tier cybersecurity vendor helps the PRC enforce content monitoring and manipulation of public opinion in China.
0
1
3
🚨 New Research Drop. 📢 Censorship as a Service | Leak Reveals Public-Private Collaboration to Monitor Chinese Cyberspace. @spiderspiders_ , @DakotaInDC , and I analyzed a leak containing infrastructure details and work logs from employees of a security firm in China. [1/2].
1
8
18
This is going to be an amazing talk. It is great to see in depth research on an increasingly relevant attack vector: the firmware. Make sure you catch it if you are attending @REverseConf.
Bootkits: the ultimate stealth threat. Takahiro Haruyama (@cci_forensics) shares cutting-edge techniques to detect UEFI implants with code behavior analysis, YARA/FwHunt rules, and retrohunts. Learn how 6 new bootkits were uncovered! #REverse2025
1
6
29