Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Operation Covert Access: Weaponized LNK-Based Spear-Phishing Targeting Argentina’s Judicial Sector to Deploy a Covert RAT
SOC Prime Bias: Critical
Seqrite
BlueNoroff Group: The Financial Cybercrime Arm of Lazarus
SOC Prime Bias: Critical
picussecurity.com
Operation Poseidon: Spear-Phishing Attacks Abusing Google Ads Redirection Mechanisms
SOC Prime Bias: Critical
co.kr
Add Punycode to your Threat Hunting Routine
SOC Prime Bias: Medium
SANS Internet Storm Center
Remcos RAT Targets Korean Users in Ongoing Distribution Campaign
SOC Prime Bias: Medium
ASEC
GlassWorm Goes Mac: Fresh Infrastructure, New Tricks
SOC Prime Bias: Critical
koi.ai
Free Converter Software – Convert Any System from Clean to Infected in Seconds
SOC Prime Bias: Medium
nextron-systems.com
DeadLock: Ransomware Gang Uses Smart Contracts to Mask Its Work
SOC Prime Bias: High
TheRegister
LOTUSLITE Campaign: Targeted Espionage Driven by Geopolitical Narratives
SOC Prime Bias: Critical
Acronis
How real software downloads can hide remote backdoors
SOC Prime Bias: Critical
Malwarebytes