How we hunt C2 infrastructure at RST Cloud using Netlas

Proactive threat hunting for malicious infrastructure: fingerprint C2 via favicon hashes, HTTP headers, TLS fields and JARM, then pivot across Netlas, Shodan and Censys to map attacker ecosystems.

Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.

Threat actors abuse Telegram's Bot API as a covert channel for phishing, telemetry and malware delivery; Netlas hunts surface Xeno lures and fake Adobe updates with stable detection anchors.

Recap of the TAI Challenge 2025 threat-hunting event with RST Cloud: 150+ registrants, five difficulty levels, 9,000+ submissions, training webinar recordings and the winners list.

Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.

Hunt announces its C2 Feed, covering how the team identifies and tracks malicious command-and-control servers and packages this intelligence to help defenders block adversary infrastructure.