Weaponized RMM: Hunting the Adversary Abuse of Remote Monitoring Tools

Threat actors abuse Telegram's Bot API as a covert channel for phishing, telemetry and malware delivery; Netlas hunts surface Xeno lures and fake Adobe updates with stable detection anchors.

How RST Cloud hunts C2 infrastructure with Netlas: a seven-step loop from goals and samples to fingerprints (JARM, certificates, HTTP headers), scheduled searches and multi-criteria validation.

Proactive threat hunting for malicious infrastructure: fingerprint C2 via favicon hashes, HTTP headers, TLS fields and JARM, then pivot across Netlas, Shodan and Censys to map attacker ecosystems.

Recap of the TAI Challenge 2025 threat-hunting event with RST Cloud: 150+ registrants, five difficulty levels, 9,000+ submissions, training webinar recordings and the winners list.

Part one of Wiz's series on tracking cloud-fluent threat actors explains why cloud-specific IOCs—IAM metadata, control plane API calls, container image names—are essential for detection and attribution in the cloud.

Measures detection maturity across MITRE ATT&CK with a logging-detection-alerting-response-prevention pipeline, letting security teams map visibility gaps in their threat detection landscape.