Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
CyberVolk Reemerges: VolkLocker’s New Features and Flaws
SOC Prime Bias: High
SentinelOne
Ransomware Targeting ESXi: Practical Hypervisor Hardening Defenses
SOC Prime Bias: Critical
Huntress
Hunting Malicious LSASS Access in Windows Environments
SOC Prime Bias: Medium
Splunk
CVE-2025-10573: Ivanti EPM Unauthenticated Stored XSS Vulnerability (Patched)
SOC Prime Bias: Critical
Rapid7
Makop Ransomware Attacks on Indian Businesses: GuLoader Delivery and Privilege Escalation
SOC Prime Bias: Critical
Acronis
Castle RAT Client Malware: Tactics, Techniques, and Tradecraft
SOC Prime Bias: Medium
Splunk
LockBit Reborn: Inside the Group’s Post-Takedown Evolution
SOC Prime Bias: High
picussecurity.com
Critical King Addons for Elementor Vulnerability Under Active Exploit
SOC Prime Bias: Critical
Wordfence
UDPGangster Attacks Spread Across Multiple Countries
SOC Prime Bias: Critical
Fortinet Blog
CoinMiner Malware Continues to Spread via USB Drives
SOC Prime Bias: Medium
ASEC