Threat Intelligence

An Undocumented OtterCookie-Lineage Build and Its Invisible C2 Fleet

Contagious Interview, OtterCookie, Reports, Threat Intelligence / 14/08/2026

How one stage-3 payload led to nine OtterCookie-related hosts, three server fingerprints, and a Contagious Interview infrastructure fleet sitting at zero detections. Author: Yury Sergeev, RST Cloud Published: 15 August 2026 Summary A client shared a single stage-3 payload from a DPRK-nexus Contagious Interview delivery chain. Deobfuscating it yielded more than a capability list: it exposed the […]

An Undocumented OtterCookie-Lineage Build and Its Invisible C2 Fleet Read More »

What a good data layer for AI-assisted CTI actually looks like

AI Agent, LLM, Threat Intelligence / 30/06/2026

Part 2 of a planned series. Part 1 looked at the iceberg costs of running CTI on an AI agent. This part looks at the architecture that makes AI, and automation, useful instead. Part 1 ended on a question: which layer of the stack is your team best placed to own, and what does a

What a good data layer for AI-assisted CTI actually looks like Read More »

Beyond Decay Curves: Rethinking IOC Scoring

IoC, RST_Engine, Threat Intelligence / 14/06/2026

This methodology now lives at /how-we-score/ as a short, evergreen reference — this post remains the full technical deep-dive. Most security teams assume IOC scoring is a solved problem. Indicators arrive from threat feeds, confidence values are assigned, decay functions reduce scores over time, and detections are prioritized accordingly. On paper, the process appears objective

Beyond Decay Curves: Rethinking IOC Scoring Read More »