Product Updates

The Rösti connector is now part of the OpenCTI connectors repository. It imports Rösti reports into OpenCTI with their IOCs, YARA rules, ATT&CK links and CVEs, and keeps them up to date.

Related IOCs, including different hashes of the same file, are now visually grouped on the website and linked through a new entity_ref field in the API.

All YARA rules in rosti.dev reports have been checked using the Python yara package, and invalid rules have been fixed where possible.

Introducing new feeds focused exclusively on command & control (C2) IOCs. Starting April 20, new IOCs will be manually reviewed and C2s are added to these curated feeds.

Starting October 1, 2026, authentication will be required for the Rösti API.

Rösti is now using a new domain rosti.dev. The old domains *.rosti.bin.re will be redirected to the new domains until at least December 31, 2026.