Sign in

Sam Hanson

@sam-hans0n.bsky.social
124 followers 272 following 22 posts

Security researcher for Dragos sam-hanson.space

PostsRepliesMedia
Sam Hanson @sam-hans0n.bsky.social · 06/05/2026
Funny, I’ve been accused by friends of being dramatic when using the term “threat actor”. These were non-technical folks who don’t know what they’re talking about, but interesting to see some folks think “threat actor” is boring and others dramatic.
010
Reposted by Sam Hanson
Jimmy Wylie @mayahustle.com · 17/02/2026
The Dragos 2026 Year In Review Report is live: 3 new threat groups, updates from 3 of our more active threat groups, and (my personal favorite) coverage of a subset ICS-related capabilities that we found last year.
dragos.com
Dragos 2026 OT Cybersecurity Report: a Year in Review
Get the latest OT threats, vulnerabilities, and lessons learned from real-world incidents in this year’s 2026 OT Cybersecurity Report.
042
Sam Hanson @sam-hans0n.bsky.social · 20/11/2025
“AI will change the average persons life” The average person using AI: (h/t Reid Wightman for finding this gem)
0186
Reposted by Sam Hanson
Might Scare-ger @mikesager.net · 19/11/2025
Every year at @cyberwarcon.bsky.social there’s an extraordinarily well sourced deeply detailed talk about a topic that I literally know nothing about but is extraordinarily fascinating. Congrats @bees.infosec.exchange.ap.brid.gy for producing this year’s edition.
1102
Sam Hanson @sam-hans0n.bsky.social · 19/11/2025
Not surprised - Jonathan truly knows his shit. Congrats Jonathan!
030
Sam Hanson @sam-hans0n.bsky.social · 19/11/2025
Me watching everyone at CYBERWARCON this week
030
Sam Hanson @sam-hans0n.bsky.social · 14/11/2025
“Four of the 16 short links were clicked, three by the senior staff members.” That’s a pretty good return rate for phishing. Blasting out hundreds of phish, as they did, and you’ll always get someone. But 25% for a given org…
media.tenor.com
a man in a basketball jersey is looking at the camera .
ALT: a man in a basketball jersey is looking at the camera .
000
Sam Hanson @sam-hans0n.bsky.social · 14/11/2025
*sends phish to John Podesta using public account on bitly to hide URL* “holy shit, this guys good…world-class, even.” Glad they got this asshole
000
Sam Hanson @sam-hans0n.bsky.social · 14/11/2025
That’s what we call an OPSEC oopsie
070
Reposted by Sam Hanson
Jimmy Wylie @mayahustle.com · 14/11/2025
Had a great time presenting at LSU this week on hunting and analyzing Go and Python malware samples while hunting for ICS malware. For those who couldn't make it, you can catch a recording of this talk from Hou.Sec.Con last month with @sam-hans0n.bsky.social www.youtube.com/watc...
021
Reposted by Sam Hanson
Jimmy Wylie @mayahustle.com · 11/11/2025
A lot of folks have reached out about Socket’s recent report on a supply chain attack using malicious NuGet packages to target Siemens S7 protocol and other PLCs. This is not a supply chain attack in the traditional sense. 1/6
132
Sam Hanson @sam-hans0n.bsky.social · 09/11/2025
That game hurt my soul, last Vikings drive was…rough to say the least.
000
Reposted by Sam Hanson
squeevey @squeevey.bsky.social · 26/10/2025
Went to a wedding and danced. Then went to a bar and danced. I didn't care about people watching me dance and people liked that I danced. Just dance.
0112
Reposted by Sam Hanson
BSides Twin Cities @bsidestc.org · 16/10/2025
See you all tomorrow at #bsidesTC at Open Book in downtown Minneapolis!
023
Reposted by Sam Hanson
Jimmy Wylie @mayahustle.com · 16/10/2025
Our DEF CON33 ICS Village talk is now on YouTube! @sam-hans0n.bsky.social and I share stories of malware we discovered while searching for ICS threats, and discuss our approach to assessing their reputation. Don't Cry Wolf: Evidence-Based Assessment of ICS Threats
youtube.com
DEF CON 33 - Don’t Cry Wolf: Evidence based assessments of ICS Threats - Jimmy Wylie & Sam Hanson
CS Malware is rare. Yet, ICS Malware like FrostyGoop and TRISIS, and related discoveries like COSMICENERGY, were all found on VirusTotal, so analysts still hunt for novel ICS Malware in public malware repositories. In the process, they discover all kinds of tools: research, CTFs, obfuscated nonsense
065
Sam Hanson @sam-hans0n.bsky.social · 16/10/2025
DEF CON talk now on YouTube! Check it out:
010
Reposted by Sam Hanson
Mara @malwaremara.bsky.social · 11/10/2025
Excited to launch the BSidesTC CTF this evening! Its been a lot of fun planning and designing the challenges with @sam-hans0n.bsky.social. I hope everyone has fun with it and I look forward to seeing how people do!
021
Reposted by Sam Hanson
BSides Twin Cities @bsidestc.org · 11/10/2025
The BSidesTC 2025 Capture The Flag challenge has officially launched. Head to our website to download the zipped executable file: bsidestc.org?page_id=145 Players will need an x86_64 Linux sandbox to start the challenge. Organizers will be available at the conference to answer any questions.
bsidestc.org
BSides:TC 2025 CTF! – Bsides Twin Cities
133
Sam Hanson @sam-hans0n.bsky.social · 11/10/2025
Dropping very soon!!
010
Reposted by Sam Hanson
Jimmy Wylie @mayahustle.com · 10/10/2025
In ICS, malware analysis can feel like archaeology. I started the week with a 13 year old sample and ended the week with @sam-hans0n.bsky.social pinging about an 18 years old sample. So, save your old Windows ISOs and VMs, you might need them!
141
Sam Hanson @sam-hans0n.bsky.social · 17/02/2025
“What made you investigate that specific sample on VirusTotal?”
020
Sam Hanson @sam-hans0n.bsky.social · 05/02/2025
Super excited about a new tool, PyLingual, a transformed based Python decompiler. This will be super useful for malware analysis, great work to the teams involved. pylingual.io/about Check out their research paper here (also fun to see Dragos cited): softsec.kaist.ac.kr/~sangkilc/pa...
pylingual.io
PyLingual
000
Sam Hanson @sam-hans0n.bsky.social · 11/12/2024
010
Sam Hanson @sam-hans0n.bsky.social · 06/12/2024
Without the direct ties to an event or IoCs, it can be difficult making that determination. Is it malware or a red teaming tool? Is it malware or a research project? It’s not always obvious. Malware repositories can contain some real gold. But without hard evidence, we can’t make conclusions.
000
Sam Hanson @sam-hans0n.bsky.social · 06/12/2024
Another day of “is it malware or is it a CTF challenge”
media.tenor.com
a black and white photo of a woman standing in front of a mirror with the words `` idk '' written on it .
ALT: a black and white photo of a woman standing in front of a mirror with the words `` idk '' written on it .
110
Sam Hanson @sam-hans0n.bsky.social · 01/12/2024
Btw - your cooking pics look incredible. Teach me your ways.
110
Sam Hanson @sam-hans0n.bsky.social · 01/12/2024
*infosec.
110
Sam Hanson @sam-hans0n.bsky.social · 01/12/2024
Agreed. I get astrophotography, infused, and cats. So much better.
110
Sam Hanson @sam-hans0n.bsky.social · 01/12/2024
The River of Doubt! It’s about Theodore Roosevelt expedition after his 1912 election loss. I just finished it today, it’s incredible what he persevered.
010
Sam Hanson @sam-hans0n.bsky.social · 01/12/2024
And yes “off the X” is a double entendre. But it feels fitting, cause Twitter became disgusting and dangerous.
000
Sam Hanson @sam-hans0n.bsky.social · 01/12/2024
Hello Bluesky community! Figured I should do an introduction. I’m a vuln/malware analyst at Dragos, specializing in malware analysis, vulnerability research, and (some) threat hunting. Big fan of anything space-related, fitness, and general nerd shit. Happy to be “off the X”… so to speak 😃
110
Sam Hanson @sam-hans0n.bsky.social · 01/12/2024
I’ve spent less than an hour on Bluesky and it already feels less toxic
020