Malware analysis
Fuxnet
Analysis of the reported Linux-wiping and Meter-bus capabilities targeting industrial sensor gateways. Co-written with Bryce Livingston.
The Internet Observatory
I'm Sam Hanson, a cybersecurity researcher focused on industrial systems and critical infrastructure.
I publish research in malware analysis, vulnerability research, and cyber threat intelligence here.
Selected research
All public research →Threat hunting
Hunting Beyond Indicators
A two-part series on behavior-based hunting, from developing hypotheses to investigating KurtLar_SCADA and a .NET Modbus binary.
Talk · DEF CON 33
Don't Cry Wolf
A talk with Jimmy Wylie on the evidence needed to assess ICS threats and distinguish suspicious capabilities from ICS-specific malware.
Featured
Public Research
Updated: at 06:39 AMPlease see this page for complete listing of public research in the form of blogs, whitepapers, and webinars.
CVEs Discovered
Updated: at 11:00 PMPlease see this page for exhaustive list of discovered and disclosed vulnerabilities.
Recent Posts
What Frontier AI Can Do in OT: Our Work with OpenAI
Published: at 12:00 PMA look at Dragos' controlled evaluations of OpenAI frontier models against industrial environments, and what the results mean for OT defenders.
CISS'26 Competition
Published: at 12:00 PMMy experience as a judge for the Critical Infrastructure Security Showdown, an international cybersecurity competition focused on operational technology.
Hunting Beyond Indicators - Part 2
Published: at 03:00 PMI wrote part two of my Hunting Beyond Indicators series for THOR Collective, walking through two real behavior-based hunts for ICS/OT-related capabilities.
Hunting Beyond Indicators
Published: at 08:57 PMI wrote a blog for THOR Collective on the value of hunting beyond Indicators of Compromise.
