Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
THREAT OF THE MONTH
Gamaredon (Primitive Bear) APT Profile with MITRE ATT&CK Mapping
SOC Prime Bias: Critical
picussecurity.com
Astaroth Malware Abuses Ngrok and Steganography for C2
SOC Prime Bias: High
picussecurity.com
BlueShell Malware Variant Linked to APT Campaigns
SOC Prime Bias: High
IIJ Security Diary
Astaroth Adds a New Spambot Component for Email Campaigns
SOC Prime Bias: High
crowdstrike.com
DEV#POPPER RAT Delivered Through Compromised Joyfill npm Releases
SOC Prime Bias: Critical
Socket
Azure VM Command Execution via a Third-Party Salt Minion Extension
SOC Prime Bias: High
NetSPI
INC Ransomware Explained: Tactics, Targets, and Impact
SOC Prime Bias: Critical
picussecurity.com
MS SQL Server Intrusion Uses GoToHTTP and SoftEther VPN for Remote Access
SOC Prime Bias: High
ASEC
MedusaHVNC Steals Live Windows Sessions Through a Hidden Desktop
SOC Prime Bias: High
BlackFog
Operation BlueDash: Multi-RMM Workplace Phishing By ZeroBEC Team
SOC Prime Bias: High
ZeroBEC
Vidar Malware Explained: Inside the Multithreaded Windows Stealer
SOC Prime Bias: High
picussecurity.com
