Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Someone’s Hands Are on Your Keyboard Then Your Whole Network. Courtesy of ClickFix, Potemkin, RMMProject and EtherRAT
SOC Prime Bias: Critical
Huntress
macOS ClickFix Lures Deploy an AppleScript Stealer and Persistent RAT
SOC Prime Bias: Critical
Netskope
How Sinobi Ransomware Encrypts Files and Destroys Backups
SOC Prime Bias: Critical
picussecurity.com
A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Worldwide
SOC Prime Bias: High
K7 Labs
Weaponized RAR Archives Used to Target Thailand’s Healthcare Sector
SOC Prime Bias: High
Seqrite Labs
Killing Me Gently: Inside Gentlemen’s EDR Killer Framework
SOC Prime Bias: Critical
welivesecurity.com
OceanLotus (APT32) Explained: Tactics, Malware, and TTPs
SOC Prime Bias: Critical
picussecurity.com
Prinz Eugen Ransomware: A Deep Dive into a New Go-Based Encryptor
SOC Prime Bias: Critical
ThreatDown by Malwarebytes
ClickFix Campaign Generated Via AI Delivers SmartRAT
SOC Prime Bias: High
zscaler.com
From Emerging Threat to Leading Ransomware-as-a-Service: The Evolution of INC Ransomware
SOC Prime Bias: Critical
Acronis