Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Your shipment has arrived email hides remote access software
SOC Prime Bias: Medium
Malwarebytes
Not Just Annoying Ads: Adware Bundles Delivering Gh0st RAT
SOC Prime Bias: Medium
Splunk
Lumma Stealer infection with Sectop RAT (ArechClient2)
SOC Prime Bias: Medium
SANS Internet Storm Center
TeamPCP Gains Ground in Cloud-Native and Ransomware Campaigns
SOC Prime Bias: Critical
Flare
Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise
SOC Prime Bias: Critical
Microsoft Security Blog
A fake Slack download is giving attackers a hidden desktop on your machine
SOC Prime Bias: Medium
Malwarebytes
ClickFix Phishing Campaign Disguised as a Claude Installer
SOC Prime Bias: Medium
Rapid7
Payouts King Takes Aim at the Ransomware Throne
SOC Prime Bias: High
ThreatLabz Ransomware Report
PowMix Botnet Targets Czech Workforce via Media Company Lure
SOC Prime Bias: Medium
Cisco Talos Blog
Smoking out an affiliate: SmokedHam, Qilin, a few Google ads and some bossware
SOC Prime Bias: High
Orange Cyberdefense