Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
Shai-Hulud Clones: TeamPCP Copycats Are Here
SOC Prime Bias: Critical
OX Security
Inside a Deno-Based Proxy and RAT
SOC Prime Bias: High
InfoGuard Labs
Operation Poisson: Breaking Down an Entire Cybercriminal Operation
SOC Prime Bias: High
Cato Networks
How a VHDX File Delivers Remcos RAT
SOC Prime Bias: High
SANS Internet Storm Center
UNC1549 TTPs: Iranian APT Targeting Aerospace and Defense
SOC Prime Bias: Critical
picussecurity.com
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit
SOC Prime Bias: Critical
Google Cloud Blog
Interlock and Rhysida: AI in the Ransomware Ecosystem
SOC Prime Bias: Critical
ibm.com
OnyxC2: A New Stealer Targeting 210 Applications
SOC Prime Bias: High
BlackFog
Analyzing SHEET#CREEP: The Malware Returns with New Config Obfuscation
SOC Prime Bias: Critical
Securonix
CVE-2026-35273: Oracle PeopleSoft Zero-Day Exploited in the Wild
SOC Prime Bias: Critical
Rapid7
Tengu Ransomware: From Initial Access to Encryption
SOC Prime Bias: High
picussecurity.com