Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Windows Service Published Through Administrator Access
SOC Prime Bias: High
Purple Team
Mustang Panda Uses ZOHOMURK and MINIRECON Against India’s Government and Energy Sectors
SOC Prime Bias: High
Acronis
Anatomy of an Attack: VIPERTUNNEL
SOC Prime Bias: High
extrahop.com
Tracking the Defence Impairment Olympics
SOC Prime Bias: Critical
Huntress
ADWS and the Hidden Path to Active Directory Enumeration
SOC Prime Bias: Medium
root@j0su
Quick Assist Full Control Mode Enabled
SOC Prime Bias: Medium
GitHub
StrikeShark Campaign Delivers Cobalt Strike Through SharkLoader
SOC Prime Bias: High
Securelist
UAC-0226 Tooling Evolution from WinRAR ADS to Reflective GIFTEDCROOK Loading
SOC Prime Bias: High
Synaptic Security Blog
SQL Brute Force Opens the Door to BlueSky Ransomware
SOC Prime Bias: Critical
The DFIR Report
Operation DragonReturn: China-Nexus Espionage Targeting India’s Tax Infrastructure
SOC Prime Bias: Critical
Seqrite Labs