Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Your AI Gateway Was a Backdoor: Inside the LiteLLM Supply Chain Compromise
SOC Prime Bias: Critical
Trend Micro
Five Browser and AI Security Questions CxOs Can’t Ignore
SOC Prime Bias: High
Palo Alto Networks Blog
Initial Access Brokers Now Target High-Value Victims and Charge Premium Rates
SOC Prime Bias: Critical
Rapid7
Inside Pay2Key: Technical Analysis of a Linux Ransomware Variant
SOC Prime Bias: High
Morphisec
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
SOC Prime Bias: Critical
Censys
From Phishing to Exfiltration: A Deep Dive into PXA Stealer
SOC Prime Bias: Medium
CyberProof
Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER
SOC Prime Bias: Medium
elastic.co
Operation DualScript: Multi-Stage PowerShell Malware Targeting Crypto and Finance
SOC Prime Bias: Critical
Seqrite
33K Exposed LiteLLM Deployments and the C2 Servers Behind TeamPCP’s Supply Chain Attack
SOC Prime Bias: High
hunt.io
T1547.006 Kernel Modules and Extensions in MITRE ATT&CK Explained
SOC Prime Bias: Critical
picussecurity.com