Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
CVE-2026-33017 Cryptominer Campaign: From Langflow to Monero
SOC Prime Bias: Critical
Trend Micro
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
SOC Prime Bias: High
Microsoft Security Blog
STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus
SOC Prime Bias: Critical
Google Cloud Blog
Microsoft Teams-Themed Phishing Campaign Delivers Remote Access
SOC Prime Bias: High
CYFIRMA
Agent Tesla Malware Analysis: Inside the .NET RAT’s Data Theft Capabilities
SOC Prime Bias: High
picussecurity.com
GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
SOC Prime Bias: High
Synaptic Security Blog
PostCSS Masquerading as a Path to Windows RAT Delivery
SOC Prime Bias: High
JFrog Security Research
PureRAT Variant Discovered in AI Video Player
SOC Prime Bias: High
lukeacha.com
SilverFox-Style Loader Chain Uses Panasonic Shells, Alibaba OSS, and Sauron
SOC Prime Bias: High
Derp
Handala Threat Group: Tactics, Targets, and Attack Timeline
SOC Prime Bias: Critical
picussecurity.com