How the RSM Defense Threat Hunting Team uncovered a sophisticated fileless RAT using one of their 300+ in-house custom detections. . Published by the RSM Defense Threat Hunting Team Author: Justin Dolgos, Threat Hunting Supervisor The Short Version Every organization generates noise. Millions of events, thousands of alerts, and endless telemetry pour into a security ... READ MORE
Blog
The Threat That Slipped Past the Machines, and Ran Into a Human
How proactive threat hunting caught an attack engineered to evade the industry's leading endpoint platforms. By Justin Dolgos, Senior Threat Hunter at RSM Defense Most malware tries to avoid your security tools. This one knew them by name. Modern attackers have learned that the fastest way past a hardened security stack is not to break it. It is to convince a trusted ... READ MORE
When Your Browser Becomes the Attacker: Detecting Drive-By Script Execution in the Wild
Published by The RSM Defense Threat Hunting Team Author: Justin Dolgos - Sr. Threat Hunter MITRE ATT&CK: T1204.002 · T1059 · T1218 · T1219 · T1222 ⚠ TLDR Executive Summary Our threat hunters built a custom detection that fires the moment a browser or Windows Explorer spawns a script or suspicious executable from a user-writable directory. In a recent ... READ MORE
Fake Captcha Chains – Portable Behaviors, Practical Detections, And Field Notes
Executive Summary RSM Defense’s Threat Hunting Team performed a focused investigation after reviewing recent intelligence on the “Fake CAPTCHA” campaign. Our hypothesis was: “If the actor is in the environment, we may observe escaped or obfuscated PowerShell commands (for example h^t^t^p) used to download and stage payloads.” The hunt confirmed activity that occurred over a ... READ MORE
Threat Hunt Report: CORNFLAKE.V3 Backdoor with Remote Code Execution Capability
Executive Summary This document presents the results of a targeted threat hunt conducted in search of tactics, techniques, and procedures (TTPs) associated with the CORNFLAKE.V3 backdoor. During the investigation, a backdoor with remote code execution capabilities was discovered; however, its direct connection to CORNFLAKE.V3 remains unconfirmed. The report details the ... READ MORE
Threat Hunting Win: Uncovering Multi-Stage Malware from RMM Abuse
At RSM Defense, we embrace a proactive approach to cybersecurity. Instead of waiting for alerts to trigger a response, our Threat Hunting team regularly conducts hypothesis-driven investigations. These investigations are designed to uncover subtle threats hiding within behavior that might seem legitimate. In late May 2025, our proactive approach paid off when we uncovered an ... READ MORE
Securing Tomorrow: Evaluating Cyber Catastrophe
On each Friday for the month of February, RSM’s Julia Polyak will be providing an article on the future of cyber-attacks and cyber-warfare, and how organizations can remain aware of emerging threats in this landscape. Please note that the views expressed in this article are opinionated and reflect the author’s perspective, and readers are encouraged to consider multiple ... READ MORE
The Weakest Link: Bridging the Gap Between Tech and People
On each Friday for the month of February, RSM’s Julia Polyak will be providing an article on the future of cyber-attacks and cyber-warfare, and how organizations can remain aware of emerging threats in this landscape. In the continuous struggle to keep our digital world safe and secure, it’s important to understand that behind every cyber event, there are roles that human’s ... READ MORE
From Borders to Bytes: Cyber as the New Global Commons
On each Friday for the month of February, RSM’s Julia Polyak will be providing an article on the future of cyber-attacks and cyber-warfare, and how organizations can remain aware of emerging threats in this landscape. For many years, there has been an ongoing debate among policymakers, scholars, and international organizations on whether cyberspace should be considered a ... READ MORE
Emerging Threats on the Horizon: Current Threat Intelligence Trends, Threats, and Mitigation Strategies
On each Friday for the month of February, RSM's Julia Polyak will be providing an article on the future of cyber-attacks and cyber-warfare, and how organizations can remain aware of emerging threats in this landscape. Cyber-attacks have become a persistent threat in today’s digital age. With the increasing dependence on technology in our personal and professional lives, the ... READ MORE