Active Threats
Explore the latest active threats being deployed by malicious actors as of Q4 2025. Each report may offer attack flows, actionable detection rules, and simulation instructions to help SOC teams stay ahead of evolving adversary techniques.
Gentlemen Ransomware Emulation Explained
SOC Prime Bias: High
AttackIQ
Iran’s Cyber Paradox: Degraded APTs, Rising Proxies, and Bootkit Wipers
SOC Prime Bias: Critical
anomali.com
MicrosoftSystem64: A Supply Chain RAT Exfiltrating Data to Hugging Face
SOC Prime Bias: Critical
SafeDep
DriveSurge Uses ClickFix and Fake Update Drive-By Attacks at Scale
SOC Prime Bias: Medium
Silent Push
NetSupport RAT Delivered by an Unidentified Loader
SOC Prime Bias: Medium
SANS Internet Storm Center
Operation Dragon Weave Uses Azure Cloud C2 to Target Czech Republic and Taiwan
SOC Prime Bias: Critical
Seqrite Labs
Detecting Nimbus Manticore and their sideloading infection chains
SOC Prime Bias: Critical
nextron-systems.com
Gamaredon’s Unfolding Toolkit: GammaPhish and GammaWorm
SOC Prime Bias: Critical
Sekoia.io Blog
Kimsuky Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant
SOC Prime Bias: Critical
co.kr
DonutLoader Reloaded in a Modern Remcos RAT Campaign
SOC Prime Bias: Medium
gdatasoftware.com