Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
RoguePlanet Exploits a Windows Zero-Day Through Defender’s Quarantine Pipeline
SOC Prime Bias: Critical
cyderes.com
Impacket for Pentesters: Network Lateral Movement and Red Teaming
SOC Prime Bias: High
Hacking Articles
Phishers Exploit Meta Business Account Manager
SOC Prime Bias: High
Huntress
Impacket for Pentesters: Password Change Techniques
SOC Prime Bias: High
Hacking Articles
CVE-2026-44963: Indicators of Veeam Backup Service Exploitation
SOC Prime Bias: Critical
GitHub
UNC6692: Exploring the SNOW Malware Ecosystem
SOC Prime Bias: Critical
extrahop.com
UAT-7810 continues building ORB networks using new malware
SOC Prime Bias: Critical
Cisco Talos Blog
ClickFix to Cash-Out: Breaking Down a Mexican Banking Fraud Toolkit
SOC Prime Bias: High
elastic.co
JADEPUFFER Uses Agentic Ransomware for Automated Database Extortion
SOC Prime Bias: Critical
sysdig.com
Windows Service Published Through Administrator Access
SOC Prime Bias: High
Purple Team
Mustang Panda Uses ZOHOMURK and MINIRECON Against India’s Government and Energy Sectors
SOC Prime Bias: High
Acronis