Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Inside a Multi-Stage Windows Malware Operation
SOC Prime Bias: High
Fortinet Blog
Swarmer Tool Evading EDR With a Stealthy Modification on Windows Registry for Persistence
SOC Prime Bias: Medium
Cyber Security News
DE&TH to Vulnerabilities: Huntress Catches SmarterMail Account Takeover Leading to RCE
SOC Prime Bias: Critical
Huntress
Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic
SOC Prime Bias: Medium
Sekoia.io Blog
When Malware Strikes Back
SOC Prime Bias: Medium
Point Wild
EncystPHP: Weaponized FreePBX Web Shell for Persistent Admin Compromise
SOC Prime Bias: Critical
Fortinet Blog
UAC-0001 (APT28) Attacks Using CVE-2026-21509
SOC Prime Bias: Critical
cert.gov.ua
Dissecting UAT-8099: New persistence mechanisms and regional focus
SOC Prime Bias: Critical
Cisco Talos Blog
Exposed Open Directory Leaks a Full BYOB Deployment Across Windows, Linux, and macOS
SOC Prime Bias: Medium
hunt.io
Novel Fake CAPTCHA Chain Delivers AMATERA Stealer
SOC Prime Bias: Medium
Blackpoint