Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Exposed Open Directory Leaks a Full BYOB Deployment Across Windows, Linux, and macOS
SOC Prime Bias: Medium
hunt.io
Novel Fake CAPTCHA Chain Delivers AMATERA Stealer
SOC Prime Bias: Medium
Blackpoint
A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor
SOC Prime Bias: Critical
Google Cloud Blog
TAMECAT – Analysis of an Iranian PowerShell-Based Backdoor
SOC Prime Bias: Critical
Pulsedive Blog
TA584 innovates initial access
SOC Prime Bias: High
Proofpoint
How NetSupport RAT Abuses Legitimate Remote Admin Tool
SOC Prime Bias: Medium
picussecurity.com
APT Attacks Target India’s Government with SHEETCREEP, FIREPOWER, and MAILCREEP | Part 2
SOC Prime Bias: Critical
Zscaler
CVE-2026-24061: GNU InetUtils Telnetd Remote Authentication Bypass
SOC Prime Bias: Critical
NSFOCUS, Inc.
APT Attacks Target India’s Government with GOGITTER, GITSHELLPAD, and GOSHELL | Part 1
SOC Prime Bias: Critical
Zscaler
The PyRAT Code: Internals of a Python-Based RAT
SOC Prime Bias: Medium
K7 Labs