Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
APT Attacks Target India’s Government with SHEETCREEP, FIREPOWER, and MAILCREEP | Part 2
SOC Prime Bias: Critical
Zscaler
CVE-2026-24061: GNU InetUtils Telnetd Remote Authentication Bypass
SOC Prime Bias: Critical
NSFOCUS, Inc.
APT Attacks Target India’s Government with GOGITTER, GITSHELLPAD, and GOSHELL | Part 1
SOC Prime Bias: Critical
Zscaler
The PyRAT Code: Internals of a Python-Based RAT
SOC Prime Bias: Medium
K7 Labs
CVE-2025-8088: Diverse Threat Actors Exploit a Critical WinRAR Flaw
SOC Prime Bias: Critical
Google Cloud Blog
The Moltbot / ClawdBots Epidemic
SOC Prime Bias: Critical
TheRegister
Fake ClowdBot VS Code Extension Drops ScreenConnect RAT
SOC Prime Bias: Critical
aikido.dev
A Shared Arsenal: Identifying Common TTPs Across RATs
SOC Prime Bias: Medium
Splunk
EndPoint Detection of Recent RMM Distribution Cases
SOC Prime Bias: Critical
ASEC
Watering Hole Attack Targets EmEditor Users with Information‑Stealing Malware
SOC Prime Bias: Critical
Trend Micro