<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>War Room</title>
	<atom:link href="https://warroom.rsmus.com/category/uncategorized/feed/" rel="self" type="application/rss+xml" />
	<link>https://warroom.rsmus.com</link>
	<description>Shells From Above</description>
	<lastBuildDate>Wed, 11 Mar 2026 21:08:36 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://warroom.rsmus.com/wp-content/uploads/2018/09/cropped-favicon-32x32.png</url>
	<title>War Room</title>
	<link>https://warroom.rsmus.com</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Fake Captcha Chains – Portable Behaviors, Practical Detections, And Field Notes</title>
		<link>https://warroom.rsmus.com/fake-captcha-chains/</link>
		
		<dc:creator><![CDATA[Justin Dolgos]]></dc:creator>
		<pubDate>Tue, 14 Oct 2025 18:28:19 +0000</pubDate>
				<category><![CDATA[Threat Intelligence]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Fake Captcha]]></category>
		<category><![CDATA[Fake Captcha Chains]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6301</guid>

					<description><![CDATA[Executive Summary RSM Defense’s Threat Hunting Team performed a focused investigation after reviewing recent intelligence on the “Fake CAPTCHA” campaign. Our hypothesis was: “If the actor is in the environment, we may observe escaped or obfuscated PowerShell commands (for example h^t^t^p) used to download and stage payloads.” The hunt confirmed activity that occurred over a [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Threat Hunt Report: CORNFLAKE.V3 Backdoor with Remote Code Execution Capability</title>
		<link>https://warroom.rsmus.com/threat-hunt-report-cornflake-v3-backdoor-with-remote-code-execution-capability/</link>
		
		<dc:creator><![CDATA[Ben McGavin]]></dc:creator>
		<pubDate>Tue, 02 Sep 2025 14:20:28 +0000</pubDate>
				<category><![CDATA[Uncategorized]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6287</guid>

					<description><![CDATA[Executive Summary This document presents the results of a targeted threat hunt conducted in search of tactics, techniques, and procedures (TTPs) associated with the CORNFLAKE.V3 backdoor. During the investigation, a backdoor with remote code execution capabilities was discovered; however, its direct connection to CORNFLAKE.V3 remains unconfirmed. The report details the hunting process, describes how the [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Securing Tomorrow: Evaluating Cyber Catastrophe</title>
		<link>https://warroom.rsmus.com/evaluating-cyber-catastrophe/</link>
		
		<dc:creator><![CDATA[RSM Author]]></dc:creator>
		<pubDate>Fri, 23 Feb 2024 21:20:25 +0000</pubDate>
				<category><![CDATA[Uncategorized]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6238</guid>

					<description><![CDATA[On each Friday for the month of February, RSM’s Julia Polyak will be providing an article on the future of cyber-attacks and cyber-warfare, and how organizations can remain aware of emerging threats in this landscape. Please note that the views expressed in this article are opinionated and reflect the author’s perspective, and readers are encouraged [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>The Weakest Link: Bridging the Gap Between Tech and People</title>
		<link>https://warroom.rsmus.com/gap-tech-people/</link>
		
		<dc:creator><![CDATA[RSM Author]]></dc:creator>
		<pubDate>Fri, 16 Feb 2024 20:11:25 +0000</pubDate>
				<category><![CDATA[Uncategorized]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=6230</guid>

					<description><![CDATA[On each Friday for the month of February, RSM’s Julia Polyak will be providing an article on the future of cyber-attacks and cyber-warfare, and how organizations can remain aware of emerging threats in this landscape. In the continuous struggle to keep our digital world safe and secure, it’s important to understand that behind every cyber [&#8230;]]]></description>
		
		
		
			</item>
	</channel>
</rss>
