Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
GammaSteel: Inside Gamaredon’s Unfolding Malware Chain
SOC Prime Bias: Critical
Sekoia.io Blog
The Evil MSI Background Returns
SOC Prime Bias: Medium
SANS Internet Storm Center
Miasma Supply Chain Attack Spreads Through the Phantom Gyp Worm
SOC Prime Bias: Critical
stepsecurity.io
C0XMO: A New Gafgyt Variant with Cross-Platform Propagation
SOC Prime Bias: Critical
Fortinet Blog
Nimbus RAT Delivered Through Microsoft Teams and Google Drive
SOC Prime Bias: Medium
eSentire
TA4922: The Suspected Chinese Crime Group is Going Global
SOC Prime Bias: Medium
Proofpoint
The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP
SOC Prime Bias: Medium
levelbluecyber
From Malspam to DesckVB RAT Deployment
SOC Prime Bias: Medium
Huntress
Fake BlueWallet steals passwords, accounts, and crypto from Macs
SOC Prime Bias: Medium
Malwarebytes
APT28 PixyNetLoader Evolution from 2024 to 2026
SOC Prime Bias: Critical
exatrack.com