Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Supply Chain Attack on Axios Pulls Malicious Dependency from NPM
SOC Prime Bias: Critical
Socket
Inside Pay2Key: Technical Analysis of a Linux Ransomware Variant
SOC Prime Bias: High
Morphisec
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
SOC Prime Bias: Critical
Censys
From Phishing to Exfiltration: A Deep Dive into PXA Stealer
SOC Prime Bias: Medium
CyberProof
Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER
SOC Prime Bias: Medium
elastic.co
Operation DualScript: Multi-Stage PowerShell Malware Targeting Crypto and Finance
SOC Prime Bias: Critical
Seqrite
33K Exposed LiteLLM Deployments and the C2 Servers Behind TeamPCP’s Supply Chain Attack
SOC Prime Bias: High
hunt.io
T1547.006 Kernel Modules and Extensions in MITRE ATT&CK Explained
SOC Prime Bias: Critical
picussecurity.com
Abusing Legitimate Low-Level Tools to Help Ransomware Evade Antivirus Detection
SOC Prime Bias: High
Seqrite
T1547.008 LSASS Driver in MITRE ATT&CK Explained
SOC Prime Bias: Critical
picussecurity.com