Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
RoguePlanet Exploits a Windows Zero-Day Through Defender’s Quarantine Pipeline
SOC Prime Bias: Critical
cyderes.com
Killing Me Gently: Inside Gentlemen’s EDR Killer Framework
SOC Prime Bias: Critical
welivesecurity.com
OceanLotus (APT32) Explained: Tactics, Malware, and TTPs
SOC Prime Bias: Critical
picussecurity.com
Prinz Eugen Ransomware: A Deep Dive into a New Go-Based Encryptor
SOC Prime Bias: Critical
ThreatDown by Malwarebytes
ClickFix Campaign Generated Via AI Delivers SmartRAT
SOC Prime Bias: High
zscaler.com
From Emerging Threat to Leading Ransomware-as-a-Service: The Evolution of INC Ransomware
SOC Prime Bias: Critical
Acronis
Malware à la Mode: Inside Dropping Elephant’s Loader Chain
SOC Prime Bias: Critical
Rapid7
Showboat Malware Targets Middle East Telecom Firms Since 2022
SOC Prime Bias: High
picussecurity.com
ErrTraffic: Inside a Growing ClickFix Malware Distribution Framework
SOC Prime Bias: High
Sekoia.io Blog
Akira, LimeWire, and the Sour Taste of Data Exfiltration
SOC Prime Bias: High
Huntress
What Was Really Inside the Shortcut File Disguised as a Privacy Consent Form?
SOC Prime Bias: High
ASEC