Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
“Copy Fail” – Linux local privilege escalation vulnerability (CVE-2026-31431)
SOC Prime Bias: Critical
Xint
AMOS Stealer Targets macOS Through “Cracked” Apps
SOC Prime Bias: Medium
Trend Micro
Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam’s Military Telecom & Philippine Healthcare
SOC Prime Bias: Critical
Seqrite
NWHStealer Spread Through Bun JavaScript Runtime
SOC Prime Bias: Medium
Malwarebytes
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
SOC Prime Bias: Medium
elastic.co
Salat Stealer Analysis Go Based RAT C2 Resilience and Info Stealing Capabilities
SOC Prime Bias: Medium
darkatlas.io
DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware
SOC Prime Bias: Critical
The Hacker News
Malicious OpenClaw Skill Distributes Remcos RAT and GhostLoader
SOC Prime Bias: Critical
Latest Version of Amadey
InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise
SOC Prime Bias: Medium
Trend Micro
Iranian-Nexus Attack Exposes 26,000 Citizen Records in Oman
SOC Prime Bias: Critical
hunt.io
Chaos Ransomware and the State-Sponsored Threat Behind It
SOC Prime Bias: Critical
Rapid7