TAI Challenge 2025 Recap

Threat actors abuse Telegram's Bot API as a covert channel for phishing, telemetry and malware delivery; Netlas hunts surface Xeno lures and fake Adobe updates with stable detection anchors.

How RST Cloud hunts C2 infrastructure with Netlas: a seven-step loop from goals and samples to fingerprints (JARM, certificates, HTTP headers), scheduled searches and multi-criteria validation.

Proactive threat hunting for malicious infrastructure: fingerprint C2 via favicon hashes, HTTP headers, TLS fields and JARM, then pivot across Netlas, Shodan and Censys to map attacker ecosystems.

Netlas maps Windows PnP auto-install from DEF CON's Plug & Pwn: the OS fetches and runs vendor packages as SYSTEM; the remote variant rides authenticated RDP, so exposure can be scoped from outside.

Adversaries treat legitimate RMM tools as an access and persistence layer: phishing now delivers remote-access clients directly; RMM abuse grew 277% year over year, with hunt pivots and IOCs.

How to find exposed configs, API keys, database credentials, bearer tokens and debug outputs at scale using Netlas response data — mapped to OWASP Top 10:2025 exposure categories.