Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
Gamaredon (Primitive Bear) APT Profile with MITRE ATT&CK Mapping
SOC Prime Bias: Critical
picussecurity.com
DeadLock Ransomware: Inside Its Rust Encryptor and Recovery Network
SOC Prime Bias: High
Microsoft Security Blog
StopRansomware: Gunra Ransomware Threat Analysis
SOC Prime Bias: Critical
CISA
CNCMachineRMS Emerges at the End of a BabaDeda Attack Chain
SOC Prime Bias: Critical
levelbluecyber
Gunra Ransomware Uses Multithreaded ChaCha20 Encryption
SOC Prime Bias: Critical
picussecurity.com
Kimsuky Expands Attack Operations with AI and Local LLMs
SOC Prime Bias: Critical
co.kr
ScreenConnect Spread at Scale Through App Store-Themed Phishing
SOC Prime Bias: High
levelbluecyber
CrowdStrike Hunts Shell Command Obfuscation on VMware ESXi
SOC Prime Bias: Critical
crowdstrike.com
How 2026’s Least-Prevented Ransomware Families Evade Defenses
SOC Prime Bias: Critical
picussecurity.com
Fake Zoom installer uses .NET downloader to deliver Overlord RAT on macOS
SOC Prime Bias: High
jamfsoftware
UAC-0145 Targets Victims Through Recruitment-Themed Social Engineering
SOC Prime Bias: Critical
cert.gov.ua
