Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
DarkGate Under the Hood
SOC Prime Bias: Medium
Sekoia.io
Clickfix on macOS: AppleScript Malware Campaign Uses Terminal Prompts to Steal Data
SOC Prime Bias: High
hunt.io
Akira Ransomware: Response to CISA Advisory AA24-109A
SOC Prime Bias: High
AttackIQ
CVE-2025-11001: NHS Warns of PoC Exploit for 7-Zip Symbolic Link–Based RCE Vulnerability
SOC Prime Bias: Critical
The Hacker News
NotDoor Insights: Deep Dive into Outlook Macros and Beyond
SOC Prime Bias: Critical
Splunk
License to Encrypt: When “The Gentlemen” Go On Offense
SOC Prime Bias: High
cybereason.com
Ransom Tales: Volume V — Emulating REvil, DarkSide, and BlackMatter Ransomware
SOC Prime Bias: Critical
AttackIQ
Targeted cyberattack on an eastern Ukraine school using the GAMYBEAR tool (CERT-UA#18329)
SOC Prime Bias: Critical
cert.gov.ua
APT41 group Tactics vs Ransomware Emulations in AttackIQ Ransom Tales
SOC Prime Bias: Critical
Hive Pro
Fortinet FortiWeb Authentication Bypass via Path Traversal Vulnerability (CVE-2025-64446)
SOC Prime Bias: Critical
horizon3.ai