Proactive Threat Hunting: Techniques to Identify Malicious Infrastructure

How RST Cloud hunts C2 infrastructure with Netlas: a seven-step loop from goals and samples to fingerprints (JARM, certificates, HTTP headers), scheduled searches and multi-criteria validation.

Threat actors abuse Telegram's Bot API as a covert channel for phishing, telemetry and malware delivery; Netlas hunts surface Xeno lures and fake Adobe updates with stable detection anchors.

Recap of the TAI Challenge 2025 threat-hunting event with RST Cloud: 150+ registrants, five difficulty levels, 9,000+ submissions, training webinar recordings and the winners list.

Part one of Wiz's series on tracking cloud-fluent threat actors explains why cloud-specific IOCs—IAM metadata, control plane API calls, container image names—are essential for detection and attribution in the cloud.

Hunt explains how it identifies, tracks and 'burns' malicious C2 servers using TLS certificates, HTTP headers, SSH keys, JARM/JA4x hashes and TCP banners, seen in Gh0st and ShadowPad cases.

Hunt announces its C2 Feed, covering how the team identifies and tracks malicious command-and-control servers and packages this intelligence to help defenders block adversary infrastructure.