Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Bitbucket API Abuse: A Simple Trick for Stealthy Data Theft
SOC Prime Bias: Medium
cocomelonc
EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons
SOC Prime Bias: Critical
eSentire
Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
SOC Prime Bias: Critical
Trend Micro
Five Browser and AI Security Questions CxOs Can’t Ignore
SOC Prime Bias: High
Palo Alto Networks Blog
Initial Access Brokers Now Target High-Value Victims and Charge Premium Rates
SOC Prime Bias: Critical
Rapid7
Supply Chain Attack on Axios Pulls Malicious Dependency from NPM
SOC Prime Bias: Critical
Socket
Inside Pay2Key: Technical Analysis of a Linux Ransomware Variant
SOC Prime Bias: High
Morphisec
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
SOC Prime Bias: Critical
Censys
From Phishing to Exfiltration: A Deep Dive into PXA Stealer
SOC Prime Bias: Medium
CyberProof
Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER
SOC Prime Bias: Medium
elastic.co