Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
A Closer Look at the Novel and Stealthy KarstoRAT Malware
SOC Prime Bias: Medium
levelbluecyber
WindowsAudit Backdoor: Inside a .NET RAT That Hides in Discord
SOC Prime Bias: Critical
Profero | Rapid-IR
Komari: The “Monitoring” Tool That Didn’t Need Weaponising
SOC Prime Bias: Critical
Huntress
Libredtail Exploits CVE-2024-4577 for Cryptomining
SOC Prime Bias: Critical
SANS Internet Storm Center
Elementary-data Compromised on PyPI and GHCR via Forged GitHub Release
SOC Prime Bias: Critical
stepsecurity.io
BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector
SOC Prime Bias: Critical
Arctic Wolf
New Malware SLOTAGENT Supporting BOF Execution Published
SOC Prime Bias: Medium
IIJ Security Diary
The Month of Bypasses: What Defender Misses
SOC Prime Bias: Medium
PSI | Nemesis
Crypto Drainers as a Converging Threat: Insights into Emerging Hybrid Attack Ecosystems
SOC Prime Bias: Medium
levelbluecyber
Rebex-based Telegram RAT Targeting Vietnam
SOC Prime Bias: Medium
dmpdump