Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
hermes-px: A Fake Privacy Proxy Exfiltrating Prompts and Tampering with Claude Code
SOC Prime Bias: Critical
JFrog Security Research
Claude Code Lures Turn GitHub Releases into a Malware Delivery Channel
SOC Prime Bias: Medium
Trend Micro
UAT-10608 Exposed: Automated Credential Theft at Scale Against Web Applications
SOC Prime Bias: Critical
Cisco Talos Blog
Malicious LNK Files Distributing a Python-Based Backdoor and Changes in Distribution Techniques (Kimsuky Group)
SOC Prime Bias: Critical
ASEC
DPRK-Related Campaigns with LNK and GitHub C2
SOC Prime Bias: Critical
Fortinet Blog
VEN0m Ransomware: the weak point of Windows Defender
SOC Prime Bias: Critical
Nexsys Srl
APT-Q-27 Malware Campaign Focuses on Web3 Customer Support
SOC Prime Bias: Critical
zeroShadow
MacOS Stealers, Observed: What Defenders Should Watch For
SOC Prime Bias: Medium
objective_see
I’d come running back to EU again: TA416 resumes European government espionage campaigns
SOC Prime Bias: Critical
Proofpoint
Cookie-Controlled PHP Web Shells: Stealth Tradecraft on Linux Hosts
SOC Prime Bias: Medium
Microsoft Security Blog