Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Void Dokkaebi Uses Cython-Compiled InvisibleFerret Malware
SOC Prime Bias: Critical
Trend Micro
Payload Ransomware: In-Depth Technical Analysis
SOC Prime Bias: High
Darkatlas
DeepLoad Malware Explained: ClickFix Delivery and Credential Theft
SOC Prime Bias: Medium
picussecurity.com
SEO Poisoning Campaign Uses Gemini and Claude Code Lures to Deliver an Infostealer
SOC Prime Bias: Medium
EclecticIQ
NightSpire Ransomware Attack Chain, Tools and Tactics
SOC Prime Bias: High
picussecurity.com
UAC-0057 Updates Its Toolkit with OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES
SOC Prime Bias: Medium
cert.gov.ua
From PDB Strings to MaaS: Tracking a Commodity BadIIS Ecosystem
SOC Prime Bias: Medium
Cisco Talos Blog
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud
SOC Prime Bias: Medium
Trend Micro
durabletask: TeamPCP’s Latest PyPI Supply Chain Compromise
SOC Prime Bias: Critical
wiz.io
Exposed RDP: The Misconfiguration That Still Pays Off for Attackers
SOC Prime Bias: Critical
Huntress