Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
VIPERTUNNEL Python Backdoor: A Deep Dive
SOC Prime Bias: High
InfoGuard Labs
In-Memory Loader Drops ScreenConnect
SOC Prime Bias: Medium
Multiple Vulnerabilities Found In ConnectWise ScreenConnect Read post
Silver Fox Wraps ValleyRAT in ZPAQ and a ByteDance Binary: A Telegram Chinese Language Pack MSI Lure
SOC Prime Bias: Critical
Breakglass Intelligence
Fake Windows Support Site Delivers Password-Stealing Malware
SOC Prime Bias: Medium
Malwarebytes
ClickFix to MaaS: Inside a Modular Windows RAT and Its Control Panel
SOC Prime Bias: Medium
Netskope
Remus: Unpacking the 64-bit Evolution of the Lumma Stealer
SOC Prime Bias: Medium
GenThreatLabs
New Whitepaper: BPFDoor Variants Hide in Plain Sight
SOC Prime Bias: Critical
Rapid7
NightSpire Ransomware Evolves: Updated Techniques and Detection Tips
SOC Prime Bias: High
Huntress
DesckVB RAT Analysis: From JavaScript Loader to Fileless .NET RAT
SOC Prime Bias: Medium
Point Wild
ChainShell: MuddyWater & Russian MaaS
SOC Prime Bias: Critical
JUMPSEC