Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery
SOC Prime Bias: High
Synaptic Security Blog
Active Directory Forest Trust Abuse and Child-to-Root Escalation
SOC Prime Bias: Critical
Hacking Articles
Aquatic Panda (Earth Lusca): Campaigns, Malware, and TTPs
SOC Prime Bias: Critical
picussecurity.com
LokiBot After a Decade: Analysis of a Recent Campaign
SOC Prime Bias: High
levelbluecyber
Gamaredon in 2025: Tunnels, Workers, Dead Drops, and New Alliances
SOC Prime Bias: Critical
welivesecurity.com
Beyond the Login Field: The Phishing Tradecraft Users Aren’t Ready For
SOC Prime Bias: High
Huntress
StealC and Amadey: Breaking Down the Infostealers and Services Behind Them
SOC Prime Bias: High
Microsoft Security Blog
KimJongRAT Continues to Evolve Through Living Off Trusted Sites
SOC Prime Bias: Critical
IIJ Security Diary
Introduction to COM usage by Windows threats
SOC Prime Bias: Medium
Cisco Talos Blog
Abusing GitLab CI Runners as a Command-and-Control Framework
SOC Prime Bias: High
vrls.ws