Telegram Bot API Abuse

How RST Cloud hunts C2 infrastructure with Netlas: a seven-step loop from goals and samples to fingerprints (JARM, certificates, HTTP headers), scheduled searches and multi-criteria validation.

Proactive threat hunting for malicious infrastructure: fingerprint C2 via favicon hashes, HTTP headers, TLS fields and JARM, then pivot across Netlas, Shodan and Censys to map attacker ecosystems.

Recap of the TAI Challenge 2025 threat-hunting event with RST Cloud: 150+ registrants, five difficulty levels, 9,000+ submissions, training webinar recordings and the winners list.

Draws parallels between computer and medical viruses and catalogs COVID-themed phishing lures, from fake doctor advisories to HR bonus emails, urging caution with links and attachments.

Explains why end-to-end encryption in apps like WhatsApp isn't overall security: encrypted channels still deliver phishing links and malware, and endpoint and application risks remain fully in play.

Netlas maps Windows PnP auto-install from DEF CON's Plug & Pwn: the OS fetches and runs vendor packages as SYSTEM; the remote variant rides authenticated RDP, so exposure can be scoped from outside.