Blog
TencShell and Gshell
THREAT INTELLIGENCE REPORT Prepared by Alexander Gould, CTI Strategist, RST Cloud Reporting date 17 August 2026 Collection Scan-derived figures are as at 10 August 2026 Active infrastructure and an exposed exploitation chain Summary Suspected China-linked operators are running an intrusion campaign against government bodies in Taiwan, Thailand, Afghanistan and the United States, and against billing…
An Undocumented OtterCookie-Lineage Build and Its Invisible C2 Fleet
How one stage-3 payload led to nine OtterCookie-related hosts, three server fingerprints, and a Contagious Interview infrastructure fleet sitting at zero detections. Author: Yury Sergeev, RST Cloud Published: 15 August 2026 Summary A client shared a single stage-3 payload from a DPRK-nexus Contagious Interview delivery chain. Deobfuscating it yielded more than a capability list: it exposed the…
What a good data layer for AI-assisted CTI actually looks like
Part 2 of a planned series. Part 1 looked at the iceberg costs of running CTI on an AI agent. This part looks at the architecture that makes AI, and automation, useful instead. Part 1 ended on a question: which layer of the stack is your team best placed to own, and what does a…
