Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
SOC Prime Bias: Critical
Trend Micro
Case Study: How Defender’s Predictive Shielding Blocked GPO-Based Ransomware Before Execution
SOC Prime Bias: High
Microsoft Security Blog
SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)
SOC Prime Bias: Medium
SANS Internet Storm Center
Malware Attack Targeting MS‑SQL Servers to Deploy the ICE Cloud Scanner (Larva-26002)
SOC Prime Bias: High
ASEC
T1547.004 in MITRE ATT&CK: Winlogon Helper Explained
SOC Prime Bias: High
picussecurity.com
RegPhantom Backdoor: Threat Analysis and Detection Insights
SOC Prime Bias: Medium
nextron-systems.com
Analyzing FAUX#ELEVATE: Threat Actors Target France with CV Lures to Deploy Crypto Miners and Infostealers Targeting Enterprise Environments
SOC Prime Bias: Medium
Securonix
When Malware Talks Back: Real-Time Interaction with a Threat Actor During the Analysis of Kiss Loader
SOC Prime Bias: Medium
gdatasoftware.com
GlassWorm Hides a RAT Inside a Malicious Chrome Extension
SOC Prime Bias: Critical
aikido.dev
Iran Conflict Drives Surge in Espionage Activity Across Middle East Targets
SOC Prime Bias: Critical
Proofpoint
