Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
New Castle Campaigns Reveal Evolving Tooling and NeedleStealer Ties
SOC Prime Bias: High
Arctic Wolf
Helpdesk Hijackers Use Teams Vishing to Deliver GoGRPC Backdoor
SOC Prime Bias: High
zscaler.com
SourTrade Campaign Delivers Browser-Assembled Malware
SOC Prime Bias: High
confiant.com
Certighost – Active Directory Certificate Services (ADCS) vulnerability (CVE-2026-54121)
SOC Prime Bias: Critical
GitHub
Q2 2026 Email Threat Landscape: Emerging Trends and Tactics
SOC Prime Bias: High
Microsoft Security Blog
BlueNoroff Uses ClickFix in a DPRK-Linked Attack Campaign
SOC Prime Bias: Critical
JUMPSEC
TAG-195 Upgrades MaaS Ecosystem with Modular Tools
SOC Prime Bias: High
recordedfuture.com
VECT 2.0 Ransomware: Breaking Down the Attack Chain
SOC Prime Bias: Critical
extrahop.com
ClearFake / CastleLoader Abuses Paste-and-Run Techniques for Malware Delivery
SOC Prime Bias: High
Red Canary
wp2shell Targets WordPress with Pre-Auth RCE and Command Execution
SOC Prime Bias: Critical
elastic.co
