Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Pulsar RAT Powers Live Chat Driven Remote Control and Advanced Infostealer Delivery via Donut Loader
SOC Prime Bias: Medium
Point Wild
Dead#Vax: Analyzing Multi Stage VHD Delivery and Self Parsing Batch Scripts to Deploy In Memory Shellcode
SOC Prime Bias: Medium
Securonix
They Got In Through SonicWall. Then They Tried to Kill Every Security Tool
SOC Prime Bias: Critical
Huntress
Voicemail Trap: German-Language Voicemail Lure Leads to Remote Access
SOC Prime Bias: Medium
Censys
19 Shades of LockBit5.0, Inside the Latest Cross-Platform Ransomware: Part 1
SOC Prime Bias: High
levelblue.com
The Godfather of Ransomware? Inside DragonForce’s Cartel Ambitions
SOC Prime Bias: High
levelblue.com
Malicious Script Delivering More Maliciousness
SOC Prime Bias: Medium
SANS Internet Storm Center
Fake Installer Chain Ends in ValleyRAT Infection
SOC Prime Bias: Critical
cybereason.com
ShadowHS: A Fileless Linux Post‑Exploitation Framework Built on a Weaponized Hackshell
SOC Prime Bias: Critical
Cyble
The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit
SOC Prime Bias: Critical
Rapid7