Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
SHADOW#REACTOR – TEXT-ONLY STAGING, .NET REACTOR, AND IN-MEMORY REMCOS RAT DEPLOYMENT
SOC Prime Bias: Medium
Securonix
Gamaredon: Abusing BITS for “Windows Update”-Style Malware Delivery
SOC Prime Bias: Critical
Synaptic Security Blog
Inside SafePay: Analyzing the New Centralized Ransomware Group
SOC Prime Bias: High
picussecurity.com
Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure
SOC Prime Bias: Critical
Red Asgard
WannaMine Cryptominer Analysis: Fileless Execution and Persistence
SOC Prime Bias: Critical
picussecurity.com
How MDR Uncovered a Multi-Stage AsyncRAT Attack Chain
SOC Prime Bias: Critical
Trend Micro
Break The Protective Shell Of Windows Defender With The Folder Redirect Technique
SOC Prime Bias: Critical
zerosalarium.com
Malware Disguised as Video Files Using RMM Tools (Syncro, SuperOps, NinjaOne, etc)
SOC Prime Bias: Critical
ASEC
Fsquirt.exe Exploit: Malicious bthprops.cpl Loading via Bluetooth
SOC Prime Bias: Medium
GitHub
EDRStartupHinder: EDR Startup Process Blocker
SOC Prime Bias: High
zerosalarium.com