Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
UNG0801: Israel-Targeted Threat Activity Driven by AV Icon Spoofing
SOC Prime Bias: Critical
Seqrite
Phishing Campaign Spoofs India’s Income Tax to Target Businesses
SOC Prime Bias: Medium
Seqrite
Active Exploitation of Gladinet CentreStack/Triofox Insecure Cryptography Vulnerability
SOC Prime Bias: Critical
Huntress
Trial, Error, and Typos: Why Some Malware Attacks Aren’t as ‘Sophisticated’ as You Think
SOC Prime Bias: Critical
Huntress
HardBit 4.0: Ransomware Analysis and Key Findings
SOC Prime Bias: High
picussecurity.com
Prince of Persia: A 10-Year Retrospective on Iranian APT Activity
SOC Prime Bias: Critical
SafeBreach
GeoServer Under Attack: Malware Coin Miner Campaigns
SOC Prime Bias: Critical
ASEC
Stealth in Layers: Unmasking the Loader used in Targeted Email Campaigns
SOC Prime Bias: Critical
Cyble
Phantom 3.5 – redential stealing malware delivered via a fake Adobe installer
SOC Prime Bias: Medium
K7 Labs
The Detection & Response Chronicles: Exploring Telegram Abuse
SOC Prime Bias: Medium
NVISO Labs