Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
SolarWinds Web Help Desk Under Active Exploitation
SOC Prime Bias: Critical
Huntress
Tenant from Hell: Prometei’s Unauthorized Stay in Your Windows Server
SOC Prime Bias: Medium
eSentire
RenEngine Loader and HijackLoader: Dual-Stage Attack Chain Fueling Stealer Campaigns
SOC Prime Bias: Medium
cyderes.com
Analysis of Suspected Malware Linked to APT-Q-27 Targeting Financial Institutions
SOC Prime Bias: Critical
CyStackSecurity
Hunting OpenClaw: Detection and Containment Guidance for Defenders
SOC Prime Bias: High
Security Joes
DYNOWIPER: Destructive Malware Targeting Poland’s Energy Sector
SOC Prime Bias: Critical
elastic.co
New Clickfix variant CrashFix deploying Python Remote Access Trojan
SOC Prime Bias: Medium
Microsoft Security Blog
Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework
SOC Prime Bias: Critical
Cisco Talos Blog
Deep-Dive Technical Analysis of Marco Stealer
SOC Prime Bias: Medium
TransferLoader
New year, new sector: Transparent Tribe targets India’s startup ecosystem
SOC Prime Bias: Critical
Acronis