Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
RenEngine Loader and HijackLoader: Dual-Stage Attack Chain Fueling Stealer Campaigns
SOC Prime Bias: Medium
cyderes.com
Analysis of Suspected Malware Linked to APT-Q-27 Targeting Financial Institutions
SOC Prime Bias: Critical
CyStackSecurity
Hunting OpenClaw: Detection and Containment Guidance for Defenders
SOC Prime Bias: High
Security Joes
DYNOWIPER: Destructive Malware Targeting Poland’s Energy Sector
SOC Prime Bias: Critical
elastic.co
New Clickfix variant CrashFix deploying Python Remote Access Trojan
SOC Prime Bias: Medium
Microsoft Security Blog
Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework
SOC Prime Bias: Critical
Cisco Talos Blog
Deep-Dive Technical Analysis of Marco Stealer
SOC Prime Bias: Medium
TransferLoader
New year, new sector: Transparent Tribe targets India’s startup ecosystem
SOC Prime Bias: Critical
Acronis
Pulsar RAT Powers Live Chat Driven Remote Control and Advanced Infostealer Delivery via Donut Loader
SOC Prime Bias: Medium
Point Wild
Dead#Vax: Analyzing Multi Stage VHD Delivery and Self Parsing Batch Scripts to Deploy In Memory Shellcode
SOC Prime Bias: Medium
Securonix