Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Unpacking Augmented Marauder’s Multi-Pronged Casbaneiro Campaigns
SOC Prime Bias: High
BlueVoyant
CrySome RAT : An Advanced Persistent .NET Remote Access Trojan
SOC Prime Bias: Medium
CYFIRMA
Resoker RAT Uses Telegram for Command and Control
SOC Prime Bias: Medium
K7 Labs
MuddyWater Exposed: Inside an Iranian APT operation
SOC Prime Bias: Critical
Ctrl-Alt-Intel
Bitbucket API Abuse: A Simple Trick for Stealthy Data Theft
SOC Prime Bias: Medium
cocomelonc
EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons
SOC Prime Bias: Critical
eSentire
Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
SOC Prime Bias: Critical
Trend Micro
Five Browser and AI Security Questions CxOs Can’t Ignore
SOC Prime Bias: High
Palo Alto Networks Blog
Initial Access Brokers Now Target High-Value Victims and Charge Premium Rates
SOC Prime Bias: Critical
Rapid7
Supply Chain Attack on Axios Pulls Malicious Dependency from NPM
SOC Prime Bias: Critical
Socket
