Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Dissecting a ModeloRAT Campaign from Teams Phishing to Domain Compromise
SOC Prime Bias: Critical
Rapid7
FamousSparrow Targets Azerbaijan’s Oil and Gas Sector
SOC Prime Bias: Critical
Bitdefender Blog
ClickFix Evolves with PySoxy Proxying
SOC Prime Bias: Critical
ReliaQuest
Shai-Hulud: Here We Go Again – Worm by TeamPCP Hits NPM and PyPI
SOC Prime Bias: Critical
JFrog Security Research
Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign
SOC Prime Bias: Critical
co.kr
Gamaredon Uses Spoofed Emails, GammaDrop, and GammaLoad
SOC Prime Bias: Critical
HarfangLab
Malware Found in Trending Hugging Face Repository
SOC Prime Bias: Critical
hiddenlayer.com
Lazarus Group Uses Git Hooks To Hide Malware DPRK’s Contagious Interview and TaskJacker campaign is now hiding its second‑stage loader inside git hooks that download InvisibleFerret and Beavertail malware
SOC Prime Bias: Critical
6lowecase6
MacSync Stealer Uses Rotating C2 Infrastructure
SOC Prime Bias: Medium
RST Cloud
Five Fake NuGet UI Packages Deliver Crypto Wallet and Credential Stealers
SOC Prime Bias: Critical
Socket